DMARC Policy Explained: none, quarantine, and reject
DMARC p=none, p=quarantine, and p=reject tell receivers what to do when authentication fails. Learn what each policy means and when to move between them.
A DMARC policy is the p= tag in your _dmarc TXT record. It tells receiving mail servers what to do when a message claiming to be from your domain fails SPF/DKIM alignment. The three common values are none, quarantine, and reject.
This article explains each policy in plain language. For the rollout sequence, use DMARC setup step-by-step. To verify the live record, use the DMARC checker.
p=none: monitor without changing delivery
p=none asks receivers to accept the message as they normally would, while still sending you aggregate reports (when rua is set). Start here. You learn which senders fail without risking inbox placement for legitimate mail.
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; pct=100
p=quarantine: treat failures as suspicious
p=quarantine asks receivers to treat failing messages with suspicion, typically by placing them in spam or a quarantine folder. It is the middle step after reports look clean. Use it long enough to catch any forgotten ESP before you move to reject.
p=reject: block impersonation
p=reject asks receivers to refuse messages that fail DMARC. This is the end state for most domains that care about brand spoofing. Legitimate mail must pass SPF or DKIM with alignment first, or customers will miss invoices and password resets.
Optional pct= can apply the policy to a percentage of mail while you ramp. sp= sets a separate policy for subdomains. Keep both intentional; defaults can surprise you.
How to choose the next step
- 1Publish `p=none` with a working
ruamailbox. - 2Read reports for two to four weeks; fix every legitimate source (see How to read DMARC reports).
- 3Move to `p=quarantine` and watch support tickets and deliverability.
- 4When failures are only abuse or noise, move to `p=reject`.
- 5Keep reporting forever so new tools surface before they break mail.
Policy vs alignment
A message can pass SPF for the envelope domain and still fail DMARC if the visible From domain does not align. Strict aspf=s / adkim=s makes that mismatch visible early. Relaxed mode is more forgiving for organisational domains but can hide configuration debt.
Verify before and after each change
After every DNS edit, run the DMARC checker or a DNS health scan. PatchPings confirms the record exists, parses, and shows the active policy alongside SPF and DKIM. Pair DNS checks with real outbound tests from each ESP.
Policy is a dial, not a badge. none gathers truth, quarantine proves you can enforce, and reject stops lookalike fraud. Turn the dial only as fast as your reports stay clean.
