dmarc=none

dmarc=none means the receiver looked for a DMARC record for the From domain and found nothing usable, so DMARC was never applied to this message. It is not a pass and not a fail. The domain owner simply hasn't asked receivers to check.

What the RFC says

RFC 9989 §9.2 defines none as no DMARC record existing for the From domain. Under §4.10.1 the receiver queries _dmarc. plus the From domain, then walks up the DNS tree to the organizational domain (and, if one publishes a record, the public suffix domain above it). If none of those has a record, §5.3.2 says DMARC doesn't apply and evaluation stops. RFC 7489 §11.2 also covered a second case: no usable From domain could be extracted. Under RFC 9989 §5.3.1, a From header with no domain or several domains also ends DMARC evaluation. Receivers differ on which result they write for that.

From: "Tom" <tom@example.net>
Authentication-Results: mx.example.org;
       spf=pass smtp.mailfrom=example.net;
       dkim=pass header.d=example.net;
       dmarc=none header.from=example.net

dmarc=none versus p=none

These are easy to confuse:

A p=none record is what RFC 9989 calls monitoring mode (§3.2.12). The owner collects reports, and receivers must not change how they handle mail because of it (§5.4). So dmarc=fail (p=NONE) still tells you the message failed, while dmarc=none tells you nothing. Microsoft adds its own twist: when no record exists, its headers may show dmarc=bestguesspass, meaning a check would have passed had a record existed. That is not a standard result.

If you received this message

Fall back on the SPF and DKIM lines and on whether they match the From domain. The analyser checks that alignment for you. Don't confuse this with spf=none, which is about a different record. In the snippet, both passed for example.net, which is decent evidence even without DMARC. But anyone can put a no-DMARC domain in From with little to stop them, so dmarc=none on mail claiming to be from a large organization is a warning sign. All major banks and providers publish DMARC.

If you own the domain

Publish a TXT record at _dmarc.yourdomain, for example v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain. That turns on reporting without affecting delivery. Read the reports, fix unaligned senders, then tighten the policy. Domains that never send mail should publish p=reject straight away. The DMARC guide covers the rollout.