What p=none is for
p=none is a monitoring policy. Receivers are asked to deliver mail even when SPF and DKIM do not align with the From domain, and to send aggregate reports if you published rua=. It is the right first record when you are not yet sure every sender is aligned. It is a weak permanent setting on a domain you use for real mail, which is why InboxMonitor scores it as a warning and subtracts 10 points.
Quarantine is a request, not a switch you control inside every mailbox. Providers apply it in their own way, often by putting failing mail in junk. Reject is stronger. This guide stops at quarantine. Do not jump to p=reject in the same edit.
Read the reports before you change p=
The rua= tag is the address that receives aggregate reports. Without it you are changing policy blind. InboxMonitor subtracts 2 points when a valid DMARC record has no reporting address. Add a mailbox you actually open, for example rua=mailto:dmarc@yourdomain, before you tighten p=.
Reports are XML from participating receivers. They show which sending sources used your domain and whether SPF or DKIM aligned. Look for sources you recognize and sources you do not. A marketing tool, a CRM, a support desk, a calendar invite, and a cold-email platform can all send as the same domain. Any one of them that fails alignment will be treated under the new policy.
Give the reports at least a couple of weeks of normal sending. A quiet weekend is not a sample. If a tool only sends on billing day, you will not see it in two days of reports.
Fix alignment, then edit one tag
For each source that fails, either add it to SPF in a way that stays under 10 DNS lookups, or turn on DKIM at that tool and publish the selector it gives you. DMARC passes if either aligned SPF or aligned DKIM passes. DKIM is the more reliable of the two when mail is forwarded, because forwarding often breaks SPF and leaves a DKIM signature in place.
When the sources you intend to keep are passing, change p=none to p=quarantine and leave everything else. Keep rua=. Do not remove the record and add a second one. DMARC should be a single TXT record at _dmarc. One edit, then wait.
A partial step some operators use is pct=. pct=10 asks receivers to apply the policy to about 10 percent of failing mail. It is optional. If you use it, raise it only after the reports still look like the mail you meant to send. InboxMonitor does not require pct=. It looks at p=.
Watch what breaks
After the change, read the next reports and your own mail. Mail you send to yourself from each tool is a useful check: one message from the CRM, one from the support desk, one from the sending platform. If a tool lands in junk and it did not before, that tool is failing alignment. Put p= back to none if the failure is something you still need, fix that tool, and try again.
Forwarded mail can fail SPF. If your readers forward messages, DKIM alignment is what keeps DMARC passing. Confirm the signature domain matches the From domain.
InboxMonitor will move the domain off the p=none warning on the next daily check once the record parses as quarantine or reject. That label change is not evidence that every mailbox accepted the mail. It only means the published policy is no longer none.
When to ask for a written plan
If several tools send as the domain and you are not sure which DNS host to edit, a written plan is safer than guessing at p=. InboxRescue Audit is a one-time report of the live checks with the records to publish. Rescue Fix adds a change plan you apply yourself, or through a limited DNS user you create and later remove. Neither promises inbox placement, a reputation change, or that receivers will honor quarantine the same way.
Stay at p=none until the reports match the senders you intend. Then change one tag. Recheck. Read the next report before you consider p=reject.