What does 'pct=0%' mean in email authentication logs?

You sent an email that failed SPF, DKIM, or DMARC checks — and it still landed in the inbox. No bounce. No spam flag. Just acceptance. That’s not a glitch. It’s pct=0% in action.

When a domain’s authentication policy shows pct=0%, it means the receiving server has opted not to enforce those checks. Failures don’t trigger rejection or spam labeling. The email is accepted anyway.

This isn't a bug — it’s a deliberate choice by email providers (like Google or Microsoft) to keep delivery flowing, even when authentication fails. The trade-off? A gap that malicious or negligent senders can exploit.

Key takeaways

  • pct=0% means no enforcement of SPF, DKIM, or DMARC results, even if they fail.
  • Receiving domains (like Gmail or Outlook) choose pct=0% to prioritize inbox delivery over strict authentication checks.
  • Spammers and low-reputation senders can send from domains with failing authentication if those domains don’t enforce policies.

Why does pct=0% allow authenticated emails to still be rejected?

You can receive an email that fails SPF, DKIM, or DMARC but still gets delivered because the domain's DMARC policy sets pct=0%—meaning no enforcement is applied, even if authentication fails. The receiving server may later reject the message based on sender reputation, content patterns, or other filters not tied to authentication. This creates misleading bounce rates, where failures appear to stem from invalid addresses or malformed syntax when the real issue is weak policy enforcement or poor sender reputation.

DMARC's p=none is not failure, but inaction

When a domain uses p=none in its DMARC record, it’s not rejecting messages—it’s saying, “I’m monitoring, but I’m not acting.” This means even if SPF or DKIM fails, the email can still be accepted by the receiving server. The receiving server doesn’t see an authentication failure as grounds for rejection, so delivery proceeds. This doesn’t mean the email is trusted—it just means the policy isn’t enforcing rules.

Likewise, some domains use p=quarantine but with pct=0%, which means they are technically enforcing a policy but applying it to zero of the messages. The effect is equivalent to p=none. It’s a common misconfiguration: a domain claims to have a policy, but due to a zero % enforcement rate, no actual enforcement occurs.

Rejection happens downstream, not because of authentication

Even with no policy enforcement, receiving servers still evaluate other factors. If a sender has poor reputation—e.g., high spam complaints, low engagement, or a history of sending to invalid addresses—receiving systems may block the message later, even if authentication checks pass.

For example, a mail server might apply heuristic scoring based on content, sender behavior, or IP reputation. An email that passes all authentication checks can still be rejected if it matches patterns associated with spam, or if the sender has been flagged in abuse databases like Spamhaus.

This leads to confusion: a sender sees "permanent failure" on an email address, but the real reason isn’t a malformed address. It’s that the domain has weak or non-enforcing policies, and the recipient’s system is rejecting it for reasons unrelated to authentication. As a result, you may end up scrubbing lists for invalid addresses that are actually valid, just from domains with poor reputations or lax security policies.

To test how your email will be treated in real inboxes—regardless of authentication—you can use real deliverability checks. MailTester’s inbox placement tool simulates delivery through major inbox providers, showing you how likely your email is to land in the inbox, spam, or be rejected.

How does pct=0% affect sender reputation and deliverability?

When a domain sets pct=0% in its DMARC policy, it allows any sender—legitimate or malicious—to pass authentication checks. This lack of enforcement inflates the pool of deliverable but unverified emails, increasing the risk of spam and spoofing. Over time, this undermines trust in the domain’s sending ecosystem, making it harder for compliant senders to reach inboxes, even when they follow all best practices. It’s like leaving your front door unlocked: anyone can enter, which eventually makes the neighborhood less safe for everyone.

Why pct=0% undermines sender reputation

DMARC is designed to protect domains from abuse by enforcing alignment between SPF and DKIM, but only when pct=0% it does nothing. This means even unauthenticated or spoofed messages can be delivered, especially if they don’t trigger other filters. The resulting spike in low-quality or malicious emails harms the overall reputation of the domain, and inbox providers (like Gmail or Outlook) respond by applying tighter filtering—often to the entire domain, not just the offenders. You might be sending clean, compliant emails, but if spammers abuse the same domain, your messages can still land in spam or be rejected.

How it impacts deliverability across the ecosystem

When DMARC fails to block bad actors due to pct=0%, it creates invisible contamination. Mail receivers can’t distinguish between good and bad senders using that domain. This leads to broader filtering and reduced deliverability, even for legitimate senders who have set up their authentication correctly. According to RFC 7483, proper DMARC deployment includes active enforcement, and failure to enforce weakens the protocol’s effectiveness. Domains with pct=0% effectively opt out of this defense mechanism, contributing to a larger problem in email trust.

For senders still unsure if their domain or list is safe, testing inbox placement and verifying address validity can catch issues early. Use inbox placement testing to see how your messages land in real inboxes, or run a single address check to validate individual recipients before sending. Bulk validation through our list verifier helps you clean and maintain sender reputation at scale.

Why 'pct=0%' is a red flag for email list quality and verification accuracy

If an email domain has a pct=0% in its DMARC policy, it means no authentication checks are enforced—even if the address appears valid. This creates a high risk of sending to non-functional, role-based, or disposable accounts. Even if the email doesn’t bounce, it may never reach a real person, harming deliverability and sender reputation. MailTester flags these risks early, so you only send to addresses likely to be both valid and authenticated.

What 'pct=0%' actually means in practice

DMARC policies use a pct parameter to specify the percentage of emails subject to enforcement. When pct=0%, the domain owner has chosen to monitor email traffic without blocking anything. This doesn’t mean the domain is broken—it just means there’s no active authentication enforcement in place.

Let’s say you send to an address on a domain with pct=0%. The receiving server might still accept the message, but it won’t verify whether it’s truly sent from an authorized source. That opens the door for spoofing, spam, and fake inbox deliveries.

According to the IETF's DMARC specification, a pct=0% policy is valid but offers no protection against unauthorized senders. It’s common in domains where authentication is under setup or in place only for monitoring.

Why this matters for your email list quality

An address might resolve successfully and not bounce—but that doesn’t mean it’s trustworthy. You could be sending to a role-based address like [email protected], a disposable inbox, or even an inactive placeholder. These accounts are often set up to receive mail but never read it, which hurts your sender reputation over time.

MailTester identifies domains with pct=0% during verification and flags them as risky. This isn’t just about delivery—it’s about trust. When you send to an unauthenticated domain, you’re gambling that the message won’t be filtered, ignored, or traced back to you as a potential spam source.

Our verification process checks for DMARC enforcement, MX records, and role-based patterns. We don’t just confirm syntax—we assess real-world deliverability risk. You can test individual addresses with our email checker or verify entire lists in bulk using our bulk verification tool. You get detailed results, including why an address was flagged—no guesswork.

Fixing the root issue means ensuring your email partners use strong authentication. But until then, detecting pct=0% domains is one of the most effective ways to avoid low-value sends and protect your standing with mailbox providers.

How MailTester detects and flags emails from domains with pct=0% policy

You’re not just checking if an email exists—you’re checking whether the domain actually enforces its own security policies. MailTester scans the domain’s SPF, DKIM, and DMARC records in real time. If DMARC is set with pct=0%, meaning no enforcement, we flag the address as risky. This happens because even if an email is technically valid, the domain allows unauthorized senders to impersonate it. We return 'risky' or 'catch-all'—never 'valid'—to warn you before you send.

What DMARC’s pct=0% means in practice

When a domain publishes a DMARC policy with pct=0%, it says, “I’m monitoring, but I won’t reject mail.” That means even forged emails from that domain can reach inboxes. It’s like locking your front door but leaving the back window open. This posture is common in domains that haven’t fully adopted authentication. It doesn’t mean the email is fake—but it means the domain is not protecting itself. That’s a red flag for deliverability.

MailTester doesn’t just look at the policy; it checks how it’s implemented. SPF records may exist, but if they don’t align with the sender, or if DMARC fails to enforce, we catch it. We validate the full chain: MX records, SPF alignment, DKIM signature presence, and DMARC policy enforcement. A single misstep—especially pct=0%—can signal that the domain is a weak point in the email ecosystem.

This risk isn’t hypothetical. According to the DMARC Roadmap, over 10% of domains with DMARC enabled still use pct=0% or pct=50% as their policy. These aren’t just mistakes—they’re systemic gaps. You don’t want to send to them if you care about inbox placement or sender reputation.

How the verdict reflects the risk

When we detect a pct=0% policy, the result won’t be ‘valid.’ It’ll be either ‘risky’ (if the mailbox appears to exist but the domain’s policies are weak) or ‘catch-all’ (if the domain accepts all addresses, regardless of real existence). These labels mean one thing: you should treat the email with caution. The in-app AI assistant explains why—pulling from the actual policy signals, alignment checks, and real-time DNS lookup results. No magic. Just technical posture.

Want to test how your list handles domains with weak policies? Run a bulk verification with MailTester’s email list verification tool. You’ll see where your list fails the authentication check—before you send.

How to verify your list when using domains with pct=0%

If your domain’s DMARC policy has pct=0%, it means no enforcement is applied — even if an email is forged, it won’t be blocked. This makes your list vulnerable to bounces, deliverability issues, and reputation damage. You can’t rely on SPF or DKIM alone. Instead, verify every email in advance using real-time checks, filter out risky or catch-all addresses, and test actual inbox delivery with MailTester’s inbox placement tools before sending.

Validate with real-time checks before sending

  • Use MailTester’s bulk verification tool to check entire lists before sending. It processes hundreds of emails instantly, flagging invalid, risky, or catch-all addresses.
  • For automated workflows, integrate with the MailTester verification API to validate addresses on the fly during sign-up or campaign prep.
  • Always verify individual addresses before sending to known domains with weak policies — even if an email looks valid, it may still deliver to spam or bounce silently.

Filter high-risk addresses and assess domain risk

  • Run the verification and look for ‘risky’ or ‘catch-all’ verdicts — especially on domains with pct=0%. These are not necessarily invalid, but they pose delivery risks.
  • Check the Domain Risk Score in the results. Domains with no policy enforcement (like pct=0%) often have higher risk scores, indicating weak email authentication practices.
  • Domains with weak policy enforcement are common targets for spoofing and can harm your sender reputation, even if the emails are technically accepted by the mail server.
  • Use MailTester’s inbox placement testing to see if messages land in the inbox, not just the spam folder. Acceptance doesn’t equal deliverability.
Even when an email is accepted by the receiving server, it may never reach the inbox. A clean inbox delivery test is the only way to know if your message will be seen.

DMARC’s pct=0% doesn’t prevent spoofing — it just doesn’t act on it. That’s why you need verification layers beyond policy. Tools like MailTester go beyond policy checks and assess real delivery behavior. No matter how strong your domain’s SPF or DKIM are, a weak DMARC policy opens the door to abuse.

For reference, RFC 7483 defines DMARC’s reporting and policy enforcement, but it doesn’t dictate how email providers act on failures — especially when pct=0%. So, don’t assume your emails are safe. Test them. Verify them. Deliver only what lands in the inbox.

What MailTester’s accuracy means for detecting authenticated but unenforced domains

MailTester’s 98.9% accuracy catches domains that authenticate emails but still accept messages despite those failures—like those with pct=0% in their DMARC policy. It identifies these risks in real time, not from outdated databases, by validating DNS records, observing live SMTP behavior, and tracking domain reputation. Unlike tools that rely on static lists, MailTester detects shifts like zero enforcement instantly, protecting your sender reputation.

Real-time validation beats static databases

Many email verification tools depend on cached data—records that might be a week or months old. That’s a problem when a domain changes its policy overnight. For example, a sender might set pct=0% in DMARC to monitor compliance rather than block messages. If your tool doesn’t see that change, you’re still trusting a domain that technically passes authentication but doesn’t enforce it. MailTester avoids this by checking DNS records and simulating actual SMTP connections in real time—ensuring you only see current, actionable data.

Let’s break down how that works. When you verify a domain, MailTester doesn’t just read a database entry. It queries the domain’s DNS records, checks if mail servers are active, then attempts to establish an SMTP connection. If the server responds and accepts a message, even with failing authentication, MailTester flags it as risky. That’s not just a pass/fail—it’s a signal: “This domain lets senders in, even when they fail to authenticate.”

Not all “valid” addresses are safe

Some domains accept any incoming email—no matter the authentication—because they’re catch-alls or have poorly configured policies. These are dangerous to send to, even if the address is technically valid. A common warning sign is when an email passes SPF or DKIM but still gets delivered despite policy failure. MailTester detects this exact gap: a domain that authenticates but doesn’t enforce it.

This distinction is critical. DMARC policies with pct=0% are explicitly designed to monitor—without blocking. If your system trusts such domains, you're exposing yourself to spoofing or low-quality traffic. MailTester surfaces these risks before you send, so you don’t waste sends or get flagged for poor deliverability.

Real-time checks aren’t just more accurate—they’re more honest. You’re not trusting a snapshot from a stale database. You’re seeing what’s happening now. See how it works for your list: verify your entire email list with full visibility into authentication risks and server behavior.

How pct=0% can be mistaken for 'valid' during basic validation

Basic email validation tools only check syntax and MX records—neither confirms whether authentication actually works. An address with pct=0% might resolve to an active server, but still end up in a catch-all or role mailbox, where messages are silently discarded. These tools wrongly label such addresses as "valid," leading to high bounce rates later. True validity requires verifying message acceptance, not just DNS presence.

What basic tools miss: the difference between delivery and acceptance

Many tools stop at checking if an email address follows the right format and if the domain has a working MX record. That’s it. They don’t send a message to test if the mailbox actually accepts it. As a result, an address might be technically “resolvable” but still point to a catch-all that blocks delivery or a role account like admin@ or sales@ that ignores incoming mail.

This is where pct=0% becomes misleading. A domain’s SPF, DKIM, and DMARC policies may fail entirely (pct=0%), but that doesn’t show up in basic checks. The tool sees an MX record and calls the address valid. In reality, even if an email arrives, it could be quarantined, blocked, or discarded without notification. You’re not just sending to a dead address—you’re sending to one that actively rejects you.

MailTester’s real-time SMTP verification catches what others miss

Unlike basic tools, MailTester performs real-time SMTP verification. We don’t just query DNS—we actually connect to the mail server and attempt to deliver a message. If the server rejects the sender or the mailbox, we flag it immediately.

This is how we catch accounts that are syntactically correct but fail authentication, or that route to catch-alls, role accounts, or disposable domains. Our accuracy rate of 98.9% comes from this deep-level validation, not just lookups. You can test single emails with our email checker, verify large lists with our bulk verification, or integrate checks directly via our verification API.

For a complete picture of deliverability, test how your messages land in inboxes using our inbox placement tool. It shows whether your message arrives in the inbox, spam folder, or is blocked entirely. This is the real test of success—not just DNS or syntax, but actual delivery acceptance.

Verdicts explained: What 'valid', 'catch-all', and 'risky' really mean in MailTester

When MailTester says an email is valid, it means the address is technically correct, the domain’s mail server is active, and the mailbox accepts messages. A catch-all verdict means the domain accepts all incoming mail—so even invalid addresses appear valid, making the result unreliable. A risky verdict flags addresses that may be role-based, temporary, or from domains with weak email authentication—like those with pct=0% in DMARC policy, which increases bounce and spam risk. These verdicts come from analyzing DNS records, server responses, and domain policies in real time.

Valid: True mailbox, real delivery potential

A valid email means the address is syntactically correct and the domain’s mail server is reachable. More than just syntax, MailTester checks whether the server responds with a positive acceptance of mail. This doesn’t guarantee inbox delivery—just that the address isn’t outright invalid. High-quality lists rely on this signal to reduce hard bounces. You can test individual addresses before sending using the email checker.

Catch-all: The illusion of validity

A catch-all domain accepts all incoming emails, regardless of whether the specific mailbox exists. This means even non-existent addresses appear valid during verification. It’s a trap for bulk senders: you can’t know if the person even exists. We detect this through server behavior patterns—when the server says “OK” to every address, it’s a clear sign. Domains with catch-all policies often have poor sender reputation and higher delivery issues. For better list hygiene, avoid or exclude them.

Risky: High bounce or deliverability danger

When MailTester labels an address as risky, it’s not just a warning—it’s a signal to act. This includes role accounts (e.g., info@, sales@), disposable email domains (like 10minutemail.com), or domains with no email authentication in place, such as those with pct=0% in their DMARC policy. A zero-percent policy means no enforcement, so spoofing is easy and such domains are often abused. A 2022 report by the Anti-Phishing Working Group notes that domains with weak or absent DMARC are disproportionately used in phishing. You can test delivery behavior with inbox placement testing.

How to integrate MailTester to catch pct=0% risks before sending

You can prevent email authentication failures with no enforcement due to pct=0% by validating every address upfront. Use MailTester’s real-time API during sign-up, connect it to your CRM or ESP via pre-built integrations, and automate list cleaning so only valid, deliverable addresses reach your campaigns. This stops bounces, protects sender reputation, and improves inbox placement.

Set up automated email validation across your workflow

  • Link MailTester directly to Mailchimp, HubSpot, Klaviyo, or SendGrid via pre-built integrations—set up in minutes without custom code.
  • Enable automated list cleaning: every new subscriber is verified in real time before being added to a list or campaign—no more dirty data seeding your sends.
  • Use the real-time API in your app to validate email addresses at signup; reject invalid, disposable, or catch-all domains before they enter your database.
  • Schedule daily bulk checks on your existing list using MailTester’s bulk verification tool—find and remove dead or risky addresses before your next send.

Verify inbox placement and authentication health

  • Test your campaigns with MailTester’s inbox placement tester—see if your emails land in the inbox, spam, or are blocked before sending to real users.
  • Check SPF, DKIM, and DMARC alignment on the fly—these are critical for authentication, and missing or misconfigured records can cause pct=0% enforcement failures.
  • Review results from real email clients (Gmail, Outlook, Apple Mail) to validate deliverability—some domains fail silently due to strict filtering even with correct headers.
  • Monitor sender reputation and blocklist status through the same workflow—early detection avoids long-term damage.
Authentication headers matter. A single missing or misaligned DKIM record can reduce deliverability by up to 85% in high-volume send environments (as reported by Return Path, now Validity).

MailTester’s 98.9% accuracy means you’re not just guessing—every verdict is backed by real-time checks of MX records, SMTP responses, and domain policies. You’re not just avoiding bounces; you’re building trust through consistent, clean data. With no credit expiration, your verification capacity grows with your list. Use the free tier—100 verifications—to test the system. Then scale with automation. The fewer invalid addresses you send, the better your reputation, the higher your inbox placement.

The bottom line: pct=0% doesn’t mean safe—just less enforced

A domain with pct=0% may accept any email, regardless of authentication failure. This lack of enforcement doesn't indicate security—it means the recipient is vulnerable to spoofing and spam.

Even if an address passes syntax and DNS checks, an email sent to a pct=0% domain may still be rejected, bounced, or delivered to spam. The real risk isn't just delivery failure—it's legitimacy being compromised.

MailTester identifies these risks by validating not just syntax or DNS, but the actual inbox placement potential. With 98.9% accuracy, you're not guessing—you’re acting on verified behavior.

Sources

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

Does pct=0% mean the domain is unsafe?

Not necessarily—but it means no enforcement of email authentication policies. Malicious or poorly configured senders can exploit this to send undetected.

Can a domain with pct=0% still reject my email?

Yes. Even if authentication fails, a domain can still reject messages based on content, volume, or reputation—even if pct=0%.

Why does MailTester flag domains with pct=0%?

Because they allow delivery despite failed authentication. This increases risk of sending to catch-alls, role accounts, or disposable emails.

How does MailTester differ from basic email validators?

It checks real-time SMTP behavior, not just syntax or DNS. It identifies catch-alls, role accounts, and policy risks like pct=0%.

Do MailTester's free verifications expire?

No. You get 100 free verifications to start, and any purchased credits never expire.

What’s the difference between a 'catch-all' and a 'risky' verdict?

Catch-all means the domain routes all emails—it may accept any address. Risky means the domain has weak policy enforcement, role account use, or disposable domain signals.

Can I test inbox placement with MailTester?

Yes. The inbox-placement testing feature simulates real-world delivery across major inboxes, including Gmail and Outlook.

How accurate is MailTester’s verdict on domain policies?

98.9% accuracy across all verdicts, verified via real-time SMTP checks, DNS analysis, and domain reputation signals.

Does MailTester detect disposable email addresses?

Yes. It identifies disposable domains through known lists and behavioral signals, such as short-lived mailbox patterns.

Can MailTester detect if a domain ignores DMARC failure?

Yes. It analyzes DMARC reports and policy settings. If the policy uses pct=0%, it flags the domain as high-risk.

How often should I clean my email list?

At least once a month. High-frequency senders should verify lists before every send campaign.

What’s the best way to integrate MailTester with SendGrid?

Use the pre-built SendGrid integration to automatically verify addresses in your lists before sending campaigns.