Why DMARC Reports Show Failures but Your Emails Still Get Delivered

You run DMARC reports. You see failure alerts. Your inbox delivery looks fine. But the policy is set to pct=0%. That’s not a bug — it’s by design. Your domain is signaling to receivers: “I’m monitoring, but I’m enforcing nothing.”

Even with failing SPF and DKIM checks, messages get delivered. The warning signs are there — but the enforcement isn’t. That gap creates false confidence, masking risks like spoofing and phishing, especially during onboarding or with third-party senders.

DMARC monitoring showing failures but no enforcement due to pct=0% is a common trap. It’s not a malfunction. It’s a configuration blind spot that can go unnoticed for months. This article explains how it happens, why it matters, and what to do about it — before attackers exploit it.

Key takeaways

  • DMARC reports showing failures while emails still deliver often mean the policy is set to pct=0%, enforcing nothing.
  • A pct=0% policy gives a false sense of security; spoofed emails can still arrive in inboxes despite detection.
  • Failure reports without enforcement are especially dangerous with third-party senders or during domain onboarding, as issues go uncorrected for extended periods.

What Does pct=0% in DMARC Mean in Practice?

When your DMARC record includes pct=0%, it means receivers are instructed to ignore your DMARC policy for every single message—effectively turning off enforcement. Even if SPF or DKIM fails, the email is treated as compliant and allowed into inboxes. This isn’t a security setting; it’s a testing phase that many organizations never move past, leaving their domains exposed to spoofing and phishing without any protective action.

Why pct=0% Doesn’t Actually Secure Your Domain

DMARC is meant to tell receivers what to do with messages that don’t pass SPF or DKIM. But with pct=0%, you’re saying, “Ignore this policy.” The result? Messages from unapproved sources—like phishers or compromised accounts—can still reach inboxes. Receivers won’t reject them, and your domain remains vulnerable, even if you have a DMARC report. It's a common mistake: setting up reporting without enforcement, believing visibility equals protection.

Even if you see reports showing thousands of DMARC failures, that doesn’t mean anything has changed. The pct=0% directive ensures those failures don’t trigger any action. Your domain’s reputation stays at risk, and attackers continue to exploit it. The RFC 7483 standard, which defines DMARC, acknowledges this is intentional—it's how you test before enforcing. But testing shouldn’t last indefinitely.

Let’s be clear: a DMARC policy with pct=0% is not a security configuration. It's a diagnostic state. It only becomes meaningful when you increase pct to 100% (or a meaningful threshold like 95%) and set a policy=reject or quarantine. Until then, your domain is still open to abuse.

Use tools like MailTester’s real-time email checker to test whether an address is actually deliverable and if your own sending infrastructure passes checks. This helps ensure you’re not unintentionally sending from invalid or risky sources that could fail DMARC. For broader list hygiene, bulk verification can weed out invalid and risky addresses before you send.

How DMARC Monitoring Confirms the Risk

Monitoring shows DMARC failures—but they don’t count if the policy has pct=0%. You're collecting data on problems that won’t be resolved. If your reports show consistent SPF or DKIM failures from your own domain, it’s a sign your sending environment needs tightening. But without enforcement, nothing stops bad messages from landing in inboxes.

DMARC report data from sources like the Spamhaus DMARC Monitoring Service or DMARC.org can still help pinpoint misconfigurations or unauthorized senders. But the real fix isn’t more monitoring—it’s action. Start with pct=100% and policy=reject only when you’re certain all legitimate senders pass authentication. Testing with pct=0% should always be temporary. When you stop using it, you stop giving attackers a free pass.

How DMARC Enforcement Works: Pct=100% vs. Pct=0%

When your DMARC policy has pct=0%, it means no messages from your domain are subject to enforcement, even if they fail SPF or DKIM checks. This is a critical gap: you’re monitoring failures, but not blocking anything. In contrast, pct=100% means all messages must pass SPF or DKIM for the policy (like "reject" or "quarantine") to apply. Without enforcement, spoofed emails using your domain can still reach inboxes, posing a risk to your brand and customers.

Why Pct=0% Leaves You Vulnerable

Let’s say your domain’s DMARC record includes p=reject but pct=0%. That means even if an attacker sends a message that fails both SPF and DKIM, your domain’s policy won’t block it. The email can still land in a recipient’s inbox, appearing legitimate. This is especially dangerous when an attacker gains access to a real employee account or uses a compromised third-party service.

Organizations with pct=0% often assume they’re protected because they see DMARC reports. But reports only show what failed — not whether those failures were enforced. Without enforcement, you’re not stopping fraud. According to data from the Anti-Phishing Working Group (APWG), domains with no enforcement are significantly more likely to be used in phishing campaigns.

Enforcement is the Difference Between Monitoring and Protection

DMARC isn’t a firewall. It’s a policy framework. The pct tag defines what percentage of messages actually get enforced. Set it to 100%, and you’re saying: “Only messages that pass SPF or DKIM should be delivered.” Set it to 0%, and you’re saying: “I’m watching the traffic, but I’m not taking action.”

Many organizations start with pct=0% to avoid disrupting legitimate email. That’s smart during rollout. But leaving it there long-term means you’re not reducing risk. The transition from monitoring to enforcement should be intentional and gradual — starting with pct=10% or pct=25%, then increasing as you verify your alignment.

If you’re running DMARC and see failures but no rejections, pct=0% is probably the cause. Check your DNS record: look for pct=0 or missing pct values (which default to 0%). Tools like DMARC Analyzer can help validate your record. If you’re unsure whether your setup is solid, you can test your domain’s email integrity with a DMARC and deliverability check to see how your emails perform in real inboxes. You’re only truly protected when policies are enforced.

What Real-World Impact Does pct=0% Have?

If your DMARC policy has pct=0%, it means you're logging malicious activity but not blocking it. Spammers and attackers can send emails from your domain without risk of being rejected. Even if your legitimate emails still deliver, they lose trust signals from providers like Google and Microsoft, and your sender reputation can erode over time. If you later bump pct to 100% without cleaning up compromised sources, delivery performance can plummet suddenly.

Spammers Have a Free Pass

With pct=0%, your domain’s authentication checks are only for observation. Anyone can send spoofed emails from your domain, and email providers won’t reject them—no matter how many times DMARC reports flag them. This is how attackers hijack your brand’s reputation without consequence.

Trust Signals Fade, Even When Delivery Works

Providers like Gmail or Outlook may still deliver your emails when pct=0%, but they often apply reduced trust scores. This can lead to increased inbox placement rates—meaning more messages land in promotions or spam folders—even if your content is clean. The technical signal is there, but the human one isn't.

Over time, repeated authentication failures from unauthorized senders can degrade your sender reputation. Even if you’re sending well, your domain’s history shows inconsistency. That’s a red flag to email services that watch for patterns across domains, and it affects future deliverability.

Let’s say you decide to enforce DMARC. You set p=none to p=reject and raise pct to 100%. If compromised addresses or misconfigured senders haven’t been cleaned up, their future messages will be blocked—possibly without warning. Your sender reputation may already be damaged from earlier failures, and sudden blocklists can follow, especially if volume spikes from legitimate sources trigger filtering.

Taking Action Before Enforcement

Before shifting to enforcement, verify your sending sources. Use real-time verification to test if addresses are active and safe. MailTester’s email checker helps you confirm whether an address can receive mail. If a sending system relies on outdated, invalid, or fake addresses, fixing them now prevents downstream delivery failures later.

Also, consider monitoring your DMARC reports with tools that parse alignment and failure reasons. RFC 7483 defines how DMARC alignment works, and understanding it helps distinguish between valid sends and spoofing attempts. This clarity helps you set pct with confidence, knowing that only authorized traffic will pass.

How to Diagnose If You're Affected by Pct=0%

If your DMARC policy includes pct=0 or p=none, your domain is not enforcing any action on failing emails—meaning spammers can still use your domain without being blocked. Even if your DMARC monitor shows failures, no remediation occurs because enforcement is disabled. This is not a bug—it's a deliberate configuration, but one that can leave your domain exposed if unintended.

Check Your DMARC Record

  1. Fetch your domain’s DMARC DNS record using a tool like MxToolbox or a compliant validator that follows RFC 7483. These tools show the full TXT record as it’s published, including all tags like pct=0 and p=none.
  2. Look for the pct=0 tag explicitly in the policy. A value of pct=0 means 0% of messages failing DMARC evaluation get rejected or quarantined, regardless of the p tag.
  3. Understand that p=none is functionally equivalent to pct=0—both disable enforcement. The p=none policy is a formal way of saying “do nothing” with failing messages, while pct=0 is a granular way of saying the same within a policy that might otherwise include enforcement.
  4. Look for rua=mailto:... to see if aggregate reports are being sent. If you’re collecting reports but not acting on them, you may be blind to abuse.
  5. Check if the policy is intended. If you’re testing DMARC, having p=none or pct=0 is normal during rollout. But if you’ve deployed this long-term, it may be a forgotten misconfiguration.

Understand the Risk and Intent

DMARC is only effective when it enforces. A pct=0 or p=none policy means all failing messages are allowed through. This does not prevent spoofing, phishing, or brand abuse—even if your domain shows 100% DMARC failure rates in monitoring tools.

If you didn’t configure this intentionally, you’re likely leaving your domain vulnerable. A DMARC policy with p=none and pct=0 can remain active for months with no alerts—especially if you're not actively reviewing reports.

For a quick check on whether your domain is exposed, use MailTester’s email checker to test if emails from your domain are passing DMARC validation. It won’t fix the policy, but it will show you how current recipients see your messages.

Common Causes of Persistent pct=0% Without Enforcement

You’re seeing DMARC failures in your reports but nothing is being blocked because your policy has pct=0%—meaning no enforcement is active. This happens when policies are set to monitor-only, often due to missing verification processes, misconfigured email systems, or the mistaken belief that reporting alone enforces security. Without enforcement, all failures are logged but ignored—leaving your domain exposed to spoofing.

Third-Party Senders Without Verification

  • Onboarding new vendors or departments without checking their email setup lets unauthorized senders use your domain—often with broken SPF or DKIM—without triggering any block.
  • Let’s say your marketing team uses a third-party email tool with no alignment. If they don’t authenticate properly, DMARC will log a failure, but with pct=0%, no user gets blocked.
  • Use bulk email verification to spot-check sender lists before onboarding; it can catch invalid or risky addresses early, reducing spoofing risk.

System Misconfigurations and Silent Failures

  • SPF or DKIM can fail due to typos, expired records, or multiple conflicting mechanisms—and still pass traffic if pct=0%.
  • Many teams never notice these issues until a phishing campaign uses their domain, even though DMARC reports show the failures consistently. The reports help, but without enforcement, they’re just noise.
  • Check your authentication setup with tools like MXToolbox or RFC 7483, which define DMARC’s structure and expectations.
  • You might not know that DMARC reports only tell you what’s failing—you still need to enforce the policy with p=reject or p=quarantine to act on them.
  • Some teams treat reporting as the end goal, not realizing it does nothing to stop attacks.
  • If your policy has pct=0% for months, you’re not protecting anyone. Enforcement doesn’t happen unless the policy itself says it does.
  • Policy changes are often forgotten after initial setup. A monitoring lapse means pct=0% can stay in place indefinitely, even when conditions change.
  • Regular audits—using real-time email validation or periodic report reviews—help catch silent gaps before attackers exploit them.
  • Don’t assume visibility equals control. If your domain is sending unauthenticated emails, and your DMARC policy isn’t enforcing, you’re running blind.

Fixing pct=0%: A Step-by-Step Process

When your DMARC reports show failures but enforcement is inactive because pct=0%, it means you're monitoring—without blocking. You’re not protecting your domain. To fix this, start by auditing every sending source, validate SPF/DKIM alignment, use real-time verification to catch invalid addresses before they send, then roll out enforcement incrementally—first to 50%, then 100%—only after confirming no legitimate emails are caught. Monitor reports continuously to adjust before damage occurs.

Step 1: Audit All Sending Domains and Subdomains

Map every domain and subdomain sending email through your ecosystem. Many organizations use subdomains like newsletter.yourcompany.com or support.yourcompany.com without updating DMARC policies. If you don’t know what's sending, you can’t secure it.

Use tools like MXToolbox’s DMARC analyzer to scan for reported senders. This helps you list actual sources—automated systems, marketing platforms, third-party vendors—to avoid missing hidden senders that cause DMARC failures.

Step 2: Validate Sender Technical Setup

Every sending source must pass SPF, DKIM, and DMARC alignment. You can’t enforce if the technical base is broken. SPF must list only legitimate IPs; DKIM should sign messages consistently; DMARC must align with both SPF and DKIM.

If a domain uses a service like HubSpot or SendGrid, verify they’re properly set up—especially if they use a subdomain. Misalignment happens often when senders don’t publish keys or include the correct tags. Use MailTester’s email checker to validate individual addresses before sending, catching invalid or non-functional ones early.

Step 3: Gradual Enforcement Rollout

Never set pct=100% overnight. Start with pct=50% to test impact on deliverability. Monitor DMARC reports daily using a tool like dmarcian or DMARC.org’s resources.

If you see legitimate emails failing, roll back and adjust your SPF or DKIM setup. Only when no critical senders are blocked should you move to 100%. This step-by-step approach prevents inbox filtering or delivery failure.

Step 4: Monitor Reports During Rollout

DMARC reports are your early warning system. They’ll show you not just where policy enforcement fails, but why—spoofed domains, misaligned headers, or third-party service issues.

Use MailTester’s inbox-placement tester to simulate real delivery scenarios. This reveals how your emails land in inboxes—not just spam folders—before you finalize configuration.

Fixing pct=0% isn’t a one-time task. It’s continuous. Treat every DMARC failure, even when pct=0%, as a signal to strengthen your infrastructure.

Why Real-Time Verification Is Critical in This Workflow

Even if your email addresses pass basic syntax checks, they can fail DMARC authentication due to misconfigured domains, catch-all setups, or risky account types—especially when you're using a new sender or expanding your list. These issues can cause delivery failures or inbox placement drops even with valid-looking addresses. You need real-time verification to catch those hidden risks before they impact your sender reputation or deliverability.

Authentication Failures Don’t Always Mean Invalid Addresses

DMARC monitoring showing failures but no enforcement (because pct=0%) is common—and deceptive. It means your domain’s policy is not enforcing blocks, so bad emails still get through. But that doesn’t mean your list is clean. Many valid addresses fail DMARC not because they’re fake, but because they’re on catch-all domains, role accounts (like sales@ or info@), or disposable email services—these are often accepted by SMTP but cause high bounce rates or spam complaints later.

Let's say your list includes 1,000 addresses. Even if 990 are syntactically valid, the 10 that are role emails or from disposable domains can still trigger spam filters or get flagged as unengaged. High volumes of these can erode your sender reputation, especially if your email provider or inbox provider tracks engagement signals. This is why checking the type of email address matters, not just its syntax.

MailTester Cues You In Before the Damage Is Done

MailTester’s bulk verification and real-time verification API test more than just syntax. It checks for invalid, role-based, disposable, and catch-all addresses—types that can fail DMARC or hurt deliverability—even when the address itself is technically valid. Its 98.9% accuracy rate is based on real SMTP and DNS checks, not guesswork.

For example, a role account like [email protected] might accept mail but never respond, leading to hard bounces. Disposables like tempmail.com are often used for spam, so even if they accept your message, they’ll flag you as spam. Catch-all domains accept all incoming mail, making them high-risk—your messages might arrive, but at the cost of reputation and tracking accuracy.

Use MailTester to clean your list before sending, especially when onboarding new senders. You can run a quick check on individual addresses or process large files through bulk verification. Integrate it with your CRM or email platform via API to flag risky addresses in real time. This prevents your domain from being penalized by receivers even when DMARC isn’t enforcing policy (pct=0%).

Authentication checks are only as strong as the list they scan. If your list includes addresses that fail DMARC due to system-level risks—like role accounts or catch-alls—your deliverability will suffer. That’s why real-time validation is not optional; it’s essential.

Integrating DMARC Monitoring with List Hygiene for Full Protection

DMARC monitoring showing failures but no enforcement due to pct=0% tells you spoofing attempts exist—but not which lists are at risk. To close that gap, pair DMARC reports with active list hygiene: remove invalid, disposable, or role-based email addresses before sending. That stops bounces, improves inbox placement, and reduces exposure to spoofing—all before attacks happen.

DMARC Reports Are Not Enough

Just seeing DMARC failures in your reports doesn’t mean your sending list is clean. A failure might come from a spoofed address that’s never on your list, or from a real address that’s already invalid or disposable. Without filtering your list first, you’re essentially sending to the same addresses that might be used in phishing campaigns.

For example, if you’re sending to a role account like [email protected], DMARC won’t block the message—but it also won’t help your deliverability. These addresses often bounce, hurt sender reputation, and are frequently ignored. That’s why automated verification is necessary.

Automated List Hygiene Prevents Problems at Scale

Let’s say you have a 100k list. You can’t manually verify every email. That’s where real-time verification comes in. Tools like MailTester scan for invalid syntax, non-existent domains, disposable inboxes, and role addresses—before you ever send.

MailTester integrates directly with your ESPs—SendGrid, Mailchimp, Klaviyo, and HubSpot—so you can verify lists inline. You can run bulk checks at https://mailtester.com/email-list-verify/, use the API for automated workflows at https://mailtester.com/api-email-checker/, or check single addresses in real time with the email checker at https://mailtester.com/email-checker/.

This reduces bounce rates meaningfully, especially when using a service like SendGrid with strict delivery thresholds. It also improves inbox placement, since ISPs see your sender reputation as more stable when only valid recipients receive mail.

A well-hydrated list is a secure list. Spoofing attempts may still show up in DMARC reports, but when they do, you’re not sending to compromised or fake addresses. That changes the threat landscape.

For a deeper look at how authentication and sending behavior affect deliverability, see the IETF’s guidance on DMARC at RFC 7483.

The Bottom Line: Do Not Ignore DMARC p=none or pct=0%

Seeing DMARC failures with pct=0% or p=none may not cause immediate delivery issues, but it signals your domain is exposed to spoofing and impersonation attacks. No enforcement means no protection, even if your inbox placement remains stable today.

DMARC failure reports are diagnostic tools, not warnings. They reveal unauthorized use of your domain—unseen at scale—without triggering action. Ignoring them leaves you blind to brand abuse and increases your risk of being flagged by recipients or spam filters later.

You must respond to these reports by identifying and authenticating all sending sources. Use verification tools like MailTester to ensure only legitimate senders are using your domain. Only then can you safely enforce DMARC policies without breaking legitimate email flows.

Sources

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

What happens when your DMARC policy has pct=0%?

No enforcement occurs—the domain’s DMARC policy is effectively inactive. Messages may still be delivered, even if they fail SPF or DKIM.

Can my email still be delivered with pct=0% in place?

Yes. DMARC with pct=0% doesn’t block messages—it only reports failures. Senders with no authentication can still reach inboxes.

Why do I see DMARC failures if pct=0%?

DMARC reports track failures regardless of enforcement. A high failure rate with pct=0% indicates weak authentication across your sending sources.

How do I fix a DMARC policy with pct=0%?

Review all sending sources, verify SPF/DKIM alignment, remove non-compliant addresses, and gradually increase pct to 100% after validation.

Does MailTester help with DMARC enforcement issues?

It doesn’t monitor DMARC, but it helps clean your sending list by identifying invalid, disposable, and catch-all addresses that might trigger DMARC failures.

Is p=none the same as pct=0%?

Yes. p=none is equivalent to pct=0% in DMARC. No enforcement is applied to messages from your domain.

Can DMARC fail without sending email?

No. DMARC checks apply only to outgoing messages. Failures reported in DMARC data are tied to actual email sends from your domain.

How long can pct=0% remain safe?

Never. Leaving pct=0% enables abuse. Even without delivery disruption, it undermines sender reputation and increases phishing risk.

Do all email providers respect DMARC with pct=0%?

Yes—but they don’t enforce it. Providers may still deliver messages, but may reduce trust or mark them as suspicious over time.

Can I use MailTester to check if my email is compliant with DMARC?

Not directly. MailTester verifies email address validity and risk profile. It does not test SPF, DKIM, or DMARC records.

What’s the best way to monitor DMARC status?

Use a DMARC reporting tool like DMARCian, Quad9, or Google Postmaster Tools to track report data and identify problematic senders.

Why should I care about DMARC if pct=0%?

Because pct=0% means no protection. You’re allowing unauthorized use of your domain. Fixing it improves security and sender reputation.