DMARC Policy Explained: p=none vs p=quarantine vs p=reject

Your DMARC policy tells receiving mail servers what to do with messages that fail authentication. It is the single most important setting in your DMARC record, and getting it right is what stops attackers from spoofing your domain.

The three DMARC policies

DMARC defines three enforcement levels through the p= tag:

• p=none is monitor-only. Mail still gets delivered as normal, but you receive reports showing who is sending as your domain. This is where every rollout should start.
• p=quarantine tells receivers to treat failing mail as suspicious, usually by routing it to the spam folder.
• p=reject tells receivers to block failing mail outright. This is full protection and the goal for every domain.

How to roll out DMARC safely

Jumping straight to p=reject can block your own legitimate mail if SPF or DKIM are not set up correctly for every sending service. Roll out in stages:

1. Publish p=none with a valid rua reporting address. You can build one with the free DMARC generator.
2. Review reports for a few weeks until every legitimate source passes SPF or DKIM with alignment.
3. Move to p=quarantine, optionally with pct= to ramp gradually.
4. Finish at p=reject once reports are clean.

DMARC builds on SPF and DKIM, so confirm those first. Our guide to SPF, DKIM and DMARC covers the full setup, and the email deliverability hub explains how authentication fits into inbox placement.

Why this matters for deliverability

A strong DMARC policy protects your brand from spoofing and signals to mailbox providers that you are a responsible sender. Combined with a clean list, it is one of the foundations of reaching the inbox. Before any large send, also verify your list so bounces do not undermine the reputation your authentication is protecting.