Seeing a _dmarc TXT record does not mean your domain is protected. The most common policy is still v=DMARC1; p=none;. That tells receivers: do not quarantine or reject failed mail on our behalf. You get visibility; you do not stop spoofing.
Across the Tranco top 1M, roughly half of domains that publish DMARC still skip enforcement (quarantine/reject at pct=100). Mid-2026 measurements even showed the enforced share slipping after the 2024 bulk-sender push. Operators published a record and stopped. This article is the exit ramp from monitor-only DMARC.
What p=none actually does
With a rua mailbox you receive aggregate reports. Receivers may still spam-folder or deliver forged messages under their own rules because your policy never asked them to reject. BIMI also refuses p=none: Gmail wants quarantine or reject with pct=100 before a brand logo can appear.
Align SPF and DKIM first
DMARC passes when SPF or DKIM authenticates and the authenticated domain aligns with the From domain. On EuroVDC corporate email the MX points to securemail.eurovdc.eu (priority 10), a typical SPF is v=spf1 mx ip4:45.84.90.12 -all, and DKIM usually lives at dkim._domainkey. Full record table: SPF, DKIM, DMARC and deliverability.
If a billing tool, CRM, or ESP sends as your From domain, its IPs or DKIM must align too. Flip to p=reject without that inventory and you reject your own invoices.
Read reports for two weeks
Create something like rua=mailto:dmarc@yourdomain.com. In the XML digests, separate known senders from phishing. When the window is clean, harden.
Raise enforcement with pct
p=quarantine; pct=10;- Then
pct=50, thenpct=100. - Finally
p=reject; pct=100;
After you edit DNS in the EuroVDC panel, respect TTL while resolvers flush. Zones on ns1.eurovdc.eu / ns2.eurovdc.eu publish from the same panel.
Common traps
- Leaving SPF at
~allwhile DMARC is reject — prefer-allfor a dedicated corporate mailbox. - Rejecting only the apex while subdomains keep sending without their own policy.
- Never reading rua — then
p=noneis dead weight.
For EU-hosted mailboxes in Sofia see corporate email.
FAQ
Is p=none required by law?
No. Bulk senders to Gmail need a DMARC record (p=none often meets the minimum). Quarantine/reject is a security goal, not the same checkbox.
What does BIMI need?
DMARC p=quarantine or p=reject with pct=100. Logo will not show on p=none alone.
No reports arriving?
Missing rua, broken TXT syntax, or too little traffic. Verify the _dmarc TXT with dig.
Can web hosting and mail DNS live in different places?
Yes, but SPF/DKIM/DMARC must live in the zone that answers for the From domain.
Do I need pct=100 with reject?
Omitting pct means 100%. Explicit pct=100 helps BIMI and clarity.
