DMARC p=none vs p=quarantine vs p=reject

The p= tag sets the policy for mail that fails DMARC. p=none asks receivers to take no action and just send reports. p=quarantine asks them to treat failing mail as suspicious, usually by placing it in spam. p=reject asks them to refuse failing mail during delivery. Receivers may apply their own judgement to your request.

Why it matters

Only enforcement policies, quarantine and reject, ask receivers to act on spoofed mail. A record stuck at p=none gives you visibility but no protection. Moving too fast has its own cost: if one of your real senders is not set up correctly, a strict policy can send your own invoices or password resets to spam or bounce them. The right order is to watch first, then tighten.

How to check

Look up your current record. On a terminal run dig TXT _dmarc.example.com +short and read the value after p=.
Read your aggregate reports and note every source of mail that fails. Fix each legitimate one.
Start enforcement gently. Move to quarantine for a portion of mail using the pct tag:

v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc-reports@example.com

Raise pct in stages while the reports stay clean, up to 100.
When you are confident, change to reject:

v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com

DNS changes can take time to reach receivers, so leave a gap between steps. The full rollout is described in Set Up DMARC: From p=none to Quarantine and Reject.

Common mistakes

Treating p=none as protection. It is monitoring only.
Moving to p=reject without reading reports first, then losing legitimate mail from a forgotten service.
Forgetting that forwarding and some mailing lists can break SPF or alter a message, so a few legitimate messages may fail even in a healthy setup.
Removing the rua tag when tightening the policy, which cuts off the reports you need to catch problems.
Setting a strict p but leaving subdomains open. Check the sp tag as well.

Frequently asked questions

Is p=none worth publishing?

Yes, as a first step. It starts the reports flowing and satisfies the minimum DMARC requirement for bulk senders, but it does not ask receivers to block spoofed mail.

Which policy should I end up with?

For a domain where all legitimate mail is authenticated, p=reject gives the strongest instruction. Some organisations stay on p=quarantine because they cannot control every sender. Choose based on what the reports show.

Will every receiver follow my policy?

Not necessarily. RFC 7489 describes the policy as a request, and receivers may weigh other signals. Large mailbox providers generally honour it for clear failures.

Ready to see how your domain is set up? Try the free website sample.