DMARC Policy Modes: p=none vs Quarantine vs Reject
DMARC has exactly one job: tell receiving servers what to do when a message fails authentication. That instruction lives in a single tag, p=, with three possible values. Here's what each one does and how to move through them without blocking your own mail.
The three modes
A message "fails DMARC" when neither SPF nor DKIM both authenticates and aligns with the visible From: domain. The policy decides what happens next:
What it does: Nothing changes about delivery. Receivers evaluate SPF, DKIM and alignment, and, crucially, send you aggregate reports. Failing mail is still delivered normally.
When to use it: Where everyone starts. Turn it on, collect reports, and build a complete picture of every source sending as your domain before you enforce anything.
What it does: Mail that fails DMARC is treated as suspicious, typically routed to the spam or Junk folder rather than the inbox. It still gets delivered, just not prominently.
When to use it: The middle step. Once your legitimate sources pass reliably, quarantine limits the damage of spoofed mail without the hard cutoff of reject. Watch reports for collateral damage.
What it does: Mail that fails DMARC is rejected at the SMTP layer: it never reaches the recipient at all. This is full enforcement and the strongest anti-spoofing protection.
When to use it: The destination. Publish it only when your reports show legitimate mail passing consistently. It's also a prerequisite for BIMI brand logos in the inbox.
The receiver has the final say
Your policy is a request, not a command. Receiving servers can, and do, override it. A mailbox provider might deliver a p=reject message from a high-reputation source anyway, or quarantine something that technically passed. That's why aggregate reports record two things: the disposition (what the receiver actually did) and the policy you published. When they disagree, the report is telling you how much the receiver trusts, or distrusts, your mail.
How to move up safely
The whole point of starting at p=none is to earn your way to p=reject without breaking delivery. A safe progression:
- Publish
p=nonewith anrua=address. Do nothing else for a couple of weeks. Let the reports accumulate. - Read the reports. Identify every legitimate source and confirm each one has aligned SPF or DKIM. Fix the ones that don't. That's the real work.
- Move to
p=quarantine. Optionally ramp withpct=25, then50, then100. Keep watching for legitimate mail landing in spam. - Move to
p=reject. Once quarantine has been quiet and your pass rate is steady near 100%, go to full enforcement.
Don't skip the middle. Publishing p=reject before your sources authenticate is the single most common way to block your own transactional and marketing mail. The reports exist so you don't have to guess.
Build and read the record
You can assemble a valid policy record with the DMARC record generator, then, once reports start arriving, drop them into the DMARC report reader to see exactly which sources are ready for the next policy step. For the full picture of how the tags fit together, see the SPF, DKIM, DMARC & BIMI guide.
Know when you're ready to enforce
Read your DMARC aggregate reports in plain English and see which sources are holding you back from p=reject.
Open the DMARC report reader