Medium SeverityDMARC

Fix: DMARC Percentage Not Set to 100%

Your DMARC record includes a pct= tag set to less than 100. Only a percentage of failing emails are subject to your DMARC policy; the rest are treated as if the policy were "none".

Quick Fix

Set `pct=100` or remove the pct tag (defaults to 100%) once you're confident in your setup.

What This Error Means

The pct= tag specifies what percentage of emails that fail DMARC should have the policy applied. For example, pct=25 means only 25% of failing emails are quarantined or rejected; the other 75% are delivered normally.

Why It Matters

While pct= is useful for gradually rolling out DMARC enforcement, leaving it at less than 100% means a significant portion of spoofed emails will still be delivered.

Step-by-Step Fix

Review your current pct value

Check your DMARC record for the pct tag.

Example

dig +short TXT _dmarc.yourdomain.com
# Look for pct= in the output

Check DMARC reports for false positives

Before increasing pct, review your aggregate reports to ensure legitimate email is passing authentication.

Increase to 100%

Update the DMARC record to enforce the policy on all failing emails.

Before

v=DMARC1; p=reject; pct=25; rua=mailto:[email protected]

After

v=DMARC1; p=reject; rua=mailto:[email protected]

Common Gotchas

Removing the pct tag entirely defaults to 100%, which is the same as pct=100.
Increasing pct too quickly without reviewing reports first may cause legitimate emails to be quarantined or rejected.
Some receivers may not fully implement the pct tag. The actual percentage of affected emails may vary slightly.

Verify Your Fix

After making changes, use our free scanner to verify the fix is working correctly. DNS changes can take up to 48 hours to propagate, but most propagate within minutes.

Frequently Asked Questions

What does pct=100 mean in DMARC?

It means 100% of emails that fail DMARC authentication will have the policy applied. This is the default if the pct tag is omitted.

Should I use pct for a gradual rollout?

Yes, pct is designed for gradual rollout. A typical path is: p=quarantine;pct=10 -> pct=50 -> pct=100, then p=reject;pct=10 -> pct=50 -> pct=100.

What happens to the emails not covered by pct?

Emails that fall outside the pct percentage are treated as if the policy were p=none. They are still reported in aggregate reports, but no enforcement action is taken.