DMARC p=none vs p=quarantine vs p=reject: Which Policy, When?

Last updated: October 2026

Every DMARC record contains one decision: the p= tag — your published instruction for what receivers should do with mail that claims to be from your domain but fails authentication. There are only three values, and choosing between them confuses people mostly because two different questions get blurred: which policy satisfies the mailbox providers' rules? and which policy actually protects my domain? They have different answers, and the gap between them is where most domains stall.

The three policies, precisely

p=none — monitor

Receivers take no action on failing mail because of DMARC — it is delivered (or filtered) exactly as it would be without a record. What you get is the reports: daily aggregate data from Google, Microsoft, Yahoo and others showing every source sending as your domain and its pass/fail status. Think of p=none as installing cameras before installing locks.

Compliance note: p=none is the minimum policy the Google/Yahoo bulk-sender rules (February 2024) and Microsoft's Outlook.com requirements (May 2025) ask for. A domain at p=none is "compliant" — and completely unprotected against spoofing. Both things are true, which is why so many businesses stop here mistakenly believing the job is done.

p=quarantine — treat as suspicious

Receivers are asked to treat failing mail as suspicious — in practice, delivery to the spam/junk folder rather than the inbox. It's the middle gear: real consequences for failing mail, but a soft landing if a legitimate sender you missed starts failing — its messages land in spam, where a motivated recipient can still find them, instead of bouncing into the void.

p=reject — refuse at the door

Receivers are asked to refuse failing mail during delivery — it never reaches any folder. This is the only policy that genuinely stops spoofing of your domain: a criminal sending as you gets nothing delivered, anywhere that honors DMARC. It's also the policy with no forgiveness for your own mistakes, which is why it's the destination, not the starting point.

How to know you're ready to move up

Readiness is evidence, not a date. From your aggregate reports, you want:

• Every source you recognize is passing — each platform you use (mailbox provider, newsletter tool, CRM, invoicing app, website forms) shows DMARC-aligned passes, not failures, for at least one to two full weeks. Don't forget the low-volume senders; reports cover all of them.
• No legitimate source is unaccounted for. Any sending IP or service you can't identify needs an answer before enforcement: it's either a forgotten tool (authenticate it) or someone spoofing you (exactly what enforcement is for).
• Volume patterns are stable — you've seen at least one full business cycle (a newsletter send, an invoicing run, a campaign) pass cleanly.

When those hold, move one stage. Then watch one more cycle before the next. The full staged walkthrough, including setting the report address first, is in our DMARC setup guide.

Two refinements worth knowing

pct= — the dimmer switch. Adding pct=25 to a quarantine or reject record applies the policy to only 25% of failing mail. It's a legitimate ramp: move to p=quarantine; pct=25, then 50, then 100, then consider reject. Most small domains can skip it — quarantine itself is already the gentle stage — but for high-volume senders it de-risks the jump.

sp= — a separate policy for subdomains. Your p= covers the root domain; sp= optionally sets a different policy for subdomains. Example: keep the root at quarantine while a subdomain you fully control goes to reject. One caution in the other direction: subdomains that platforms send from (like a marketing subdomain) inherit your policy unless you set their own records — a root p=reject plus a forgotten sending subdomain is a self-inflicted outage.

Alignment modes, briefly

DMARC passes when SPF or DKIM passes aligned. Relaxed alignment (the default) means the authenticated domain and your From: domain share the same organizational domain — subdomains count. Strict alignment (adkim=s / aspf=s) requires an exact match. Strict breaks common legitimate setups (platforms signing from subdomains) and buys a small business essentially nothing. Leave the defaults alone; note them only so a checker flagging "relaxed alignment" doesn't scare you — relaxed is correct for almost everyone.

The bottom line

p=none is where you start (and all the big providers' rules require, at minimum). p=quarantine is where you prove enforcement is safe. p=reject is where the protection actually is. Domains that skip the middle step gamble their own mail; domains that never leave the first step have compliance without protection. The reports tell you when to move — if reading them is the part you're stuck on, the Email Authentication Kit includes a plain-English report-reading guide, and the free wizard prints all three stage records for your domain so each move is a one-line edit.