DMARC p=none vs quarantine vs reject. Which Policy Should You Run?

What the p= tag actually does

A DMARC record is one TXT entry at _dmarc.yourdomain.com. The single most important field is p=, the policy. It tells receiving mail servers what to do with a message that claims to be from your domain but fails DMARC — meaning it is neither SPF-aligned nor DKIM-aligned to the domain in the visible From: header.

dig +short txt _dmarc.example.com
"v=DMARC1; p=none; rua=mailto:dmarc@example.com; fo=1"

The policy has exactly three legal values, and they map to escalating consequences for mail that fails. Picking one without understanding the others is how senders either leave the door wide open (none forever) or bounce their own invoices (reject too soon).

p=none vs quarantine vs reject, side by side

Why everyone starts at p=none

p=none is monitor-only. Failing mail is still delivered, but receivers send you aggregate (RUA) reports listing every IP that sent mail claiming to be your domain, and whether each passed SPF, DKIM, and alignment. This is the discovery phase, and you cannot skip it. Most organizations are genuinely surprised by what shows up: a forgotten marketing tool, the helpdesk, the billing system, a contractor's server.

_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com; fo=1"

The rua address is where the daily XML reports land (point it at a parser, not a human inbox). fo=1 asks for a failure report whenever any authentication mechanism fails, which speeds up debugging. Stay here until the reports show every legitimate source aligned — and not a day longer, because none protects nobody.

Stepping up to p=quarantine

quarantine is the soft landing. Mail that fails DMARC is delivered to the spam folder rather than the inbox. The reason to stop here on the way up, rather than jumping straight to reject, is forgiveness: if you missed a legitimate stream in the reports, your customers' mail lands in spam and someone notices and complains — recoverable. Under reject that same mail bounces silently and you lose it.

_dmarc.example.com.  TXT  "v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@example.com"

Note the pct=25: apply the quarantine policy to a random quarter of failing mail and treat the rest as none. Watch the reports for a week, raise to pct=50, then pct=100. It is a volume dial for risk.

Reaching p=reject, the only policy that stops spoofing

p=reject is the destination. Failing mail is refused at the SMTP layer and never reaches the recipient. This is what actually stops someone from sending phishing mail with your domain in the From line — every DMARC-honoring receiver (effectively all of Gmail, Outlook, Yahoo) will turn it away. It is also the bar you must clear before BIMI will show your logo in the inbox.

_dmarc.example.com.  TXT  "v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc@example.com; adkim=s; aspf=s"

Here sp=reject extends the policy to subdomains you never send from (a favorite spoofer trick), and adkim=s; aspf=s tighten alignment from relaxed to strict once you are confident every stream signs with an exact-match domain.

The safe migration path: verify before each step

The whole ramp is gated on one question: can I see all my legitimate mail in the reports, and is it aligned? Before each step up, confirm:

1. Before none → quarantine: every legitimate sending source appears in your aggregate reports, and each one passes SPF alignment, DKIM alignment, or both. Zero surprises for two to four weeks.
2. Before raising pct: no new failing-but-legitimate sources have appeared since the last bump, and your spam-folder complaints have not risen.
3. Before quarantine → reject: you have run pct=100; p=quarantine for at least a week with clean reports. Nothing legitimate is landing in spam.
4. After reject: watch reports for another week. A stream that breaks now bounces, so this is the window to catch a forgotten quarterly mailer or an annual renewal notice.

Monitoring through the ramp, and after

DMARC is not a set-and-forget record. The policy that was safe at reject last quarter breaks the moment someone adds a new mail tool without aligning it, rotates a DKIM key and forgets the new selector, or lets an SPF include drift. Because reject bounces rather than warns, you find out from lost mail, not a heads-up.

DomainsDoc reads your DMARC record continuously — the policy value, the alignment mode, the reporting tags, and whether the record still parses after a registrar migration clobbers it — and alerts you the moment your policy weakens or your alignment slips. Add your domain to see your current policy and where it sits on the staircase, and check pricing for continuous monitoring as you ramp.