dmarc.percentage Reviewed July 2026

Quick fix

Use aggregate reports to quantify legitimate DMARC failures before increasing coverage.

What this finding means

SecuTest reads `pct`, which defaults to 100 when omitted. A lower value is useful during staged deployment but weakens coverage if retained permanently.

Interpretation boundary Use the exact evidence in your report. SecuTest reports externally observable conditions; it does not assume ownership, exploitability, compromise, or business intent when those cannot be proven remotely.

Associated attack or threat scenario

Threat type Partial anti-spoofing enforcement

How the attack or failure scenario works

An attacker sends messages that fail DMARC. With a reduced percentage, some receivers may apply the policy to only a subset of those messages. The exact sampling behavior is receiver-controlled, so the domain cannot predict which forged messages avoid the requested disposition.

Conditions and limitations

  • The DMARC policy is `quarantine` or `reject` with `pct` below 100.
  • A forged message fails aligned SPF and DKIM.
  • The receiver implements percentage-based sampling and the message falls outside the enforced subset.

Why it matters

Security and business impact A `pct` value below 100 intentionally leaves part of failing mail outside the requested enforcement policy.

Step-by-step fix

Where to make the change

  • The authoritative DNS zone for the registrable domain.
  • The outbound or inbound mail platform when sender authorization, signing, or routing is involved.
  • The DMARC reporting mailbox or reporting service when aggregate reports are required.

Remediation procedure

  1. Use aggregate reports to quantify legitimate DMARC failures before increasing coverage.
  2. Fix each unauthorized or misaligned production sender.
  3. Increase `pct` in measured steps, monitoring support tickets and delivery metrics.
  4. Set `pct=100` or omit the tag once the policy is stable.

Commands and configuration examples

Replace example values with the hostname, selector, IP address, port, provider, or policy values shown in your SecuTest evidence. Review every example before production use.

Staged example
v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc-reports@example.com

Full coverage
v=DMARC1; p=reject; pct=100; rua=mailto:dmarc-reports@example.com

Verify the fix

  1. Query the record and confirm the effective percentage.
  2. Review aggregate report dispositions and failure sources after each increase.
  3. Send representative messages from every authorized platform.
  4. Repeat SecuTest and confirm the policy applies to 100 percent.
Confirm the externally visible result

After DNS, CDN, certificate, mail, or application propagation completes, run a fresh SecuTest scan and compare the new evidence with the original finding.

Re-scan your domain

Common mistakes

  • Treating low `pct` as permanent protection rather than a migration control.
  • Increasing coverage without checking legacy applications and marketing platforms.
  • Assuming the same messages are sampled consistently across receivers.

Authoritative references