Is your DMARC policy still quarantine or reject?

Your DMARC policy can change to none without bouncing your mail. The record still exists, so checking that it's present won't tell you whether it still asks receivers to act on forged mail.

The p tag sets your policy for mail that fails DMARC. With p=reject, you say that mail isn't a valid use of your domain. With p=quarantine, you say it's suspicious. With p=none, RFC 9989 says the domain owner "offers no expression of preference."

One edit to the TXT record at _dmarc.example.com changes that request:

Before: v=DMARC1; p=reject; rua=mailto:dmarc@example.com
After:  v=DMARC1; p=none; rua=mailto:dmarc@example.com

How we check your policy

We check for changes like this because your mail can keep flowing after your policy changes.

Add a DNS monitor for example.com and pick DMARC as the record type. A new monitor ticks DMARC present and DMARC set to quarantine or reject. DMARC set to quarantine or reject holds when the name has exactly one DMARC record and its p is quarantine or reject.

The edit above breaks DMARC set to quarantine or reject. Deleting the record breaks DMARC present too. We alert only when an assertion you've ticked breaks or recovers.

After the first scan, you can pin the record with DNS answer unchanged. Any later edit to it alerts, such as a new report address.

What the check misses

On your domain, DMARC set to quarantine or reject reads only p, so a record with p=reject; sp=none passes, though sp sets the policy for your subdomains. A monitor on a subdomain with no record of its own reads your domain's record and its sp.

If you're at p=none on purpose, reading reports before you enforce, leave DMARC set to quarantine or reject unticked until you move to quarantine.