The direct answer
A monitoring-only p=none policy does not satisfy BIMI enforcement requirements. The BIMI Group calls for quarantine or reject across the relevant domain scope, without partial enforcement.
Is a DMARC pass enough?
No. An individual message can pass DMARC while the domain publishes a monitoring-only policy. Message authentication and the policy requested for failing mail are different pieces of the setup.
Check the actual applicable policy, including the organisational domain and subdomains in scope. A record on one hostname is not evidence that every sending identity meets the requirements.
Should I switch straight to reject?
First inventory legitimate senders and review their authentication. Fix alignment problems and assess the impact of an enforcement change with the team responsible for mail delivery. Moving too quickly can disrupt legitimate systems.
Use reports and real message samples to inform the transition. Treat the enforced policy as the result of authentication work, not a cosmetic setting to change solely to unlock an inbox logo.
Sources & further reading
Provider guidance checked on . Requirements can change; check the original guidance when implementing. Planning checklists and examples are BIMI World’s editorial suggestions.