Email authentication

SPF lists who may send. DKIM signs the message. DMARC is the policy when those fail. p=none forever is observation, not a policy.

First principles

Anyone can put your domain in the From line. Receiving servers will believe it unless you publish three DNS records that work together. SPF (Sender Policy Framework) lists which hosts may send mail for the domain. DKIM (DomainKeys Identified Mail) attaches a signature the receiver can check against a public key in DNS. DMARC (Domain-based Message Authentication, Reporting and Conformance) tells the receiver what to do when SPF and DKIM do not align with the visible From domain.

Alignment is the point. A signature from a vendor's domain does not protect your From if DMARC cannot see that the domains match. SPF that ends in +all is a welcome mat. DKIM without DMARC is a signature nobody is required to honour.

p=none is not a policy

DMARC p=none means 'watch, do not act'. It is how you start: collect reports, find the senders you forgot (the CRM, the invoice platform, the printer). It is not where you stop. Leaving p=none forever advertises that spoofed mail should still be delivered. Policy is p=quarantine, then p=reject, once the legitimate senders are in SPF and DKIM.

What an admin actually does

Inventory every system that sends as you: mail server, SaaS, marketing, ticketing, scanners. Each one in SPF and/or DKIM.
Publish DMARC at p=none with a rua mailbox you actually read. Fix the gaps the reports show.
Move to quarantine, then reject. Set a date. 'Forever none' is the failure mode.
SPF has a lookup limit. Flatten or include carefully. Do not keep adding vendors until the record silently fails.