DMARC has three policies, and each one tells mail providers what to do with a message that claims to be from your domain but fails authentication. With p=none, the message is delivered normally and you only get reports. With p=quarantine, it goes to the spam or junk folder. With p=reject, the receiving server refuses it, so it never reaches the recipient at all. Most domains should start at none, move to quarantine once their own mail passes, and finish at reject, usually within one to three months.
The Three Policies at a Glance
The policy is the p tag in your DMARC record, such as v=DMARC1; p=reject. Here is what each setting does to a message that fails DMARC:
| Policy | What happens to failing mail | Stops spoofing? | Best for |
|---|---|---|---|
| p=none | Delivered as normal; reports only | No | The first few weeks, while you find every service that sends as your domain |
| p=quarantine | Delivered to spam or junk | Partly | A short middle step while you confirm nothing legitimate is failing |
| p=reject | Refused by the receiving server | Yes | The final setting for almost every domain, and the starting point for domains that never send email |
Only quarantine and reject actually protect anyone. A policy of none is a measuring tool, not a defense.
What p=none Does
A policy of none asks receivers to treat failing mail exactly as they would without DMARC and to send you reports about it. Nothing is blocked and nothing goes to spam because of DMARC, so it is safe to publish on any domain, even before you know which services send mail for you.
The value of none is in the reports. Each day, large mail providers send a summary of every server that sent mail using your domain, how many messages it sent and whether those messages passed SPF, DKIM and alignment. That list usually turns up a few surprises: a billing system, an old newsletter tool or a help desk that sends as your domain without being set up correctly.
The common mistake is stopping here. A domain left at p=none for years gets reports, but a scammer can still send mail that looks like it came from you, and it will be delivered. A policy of none with no rua address is worse still, because it produces no reports at all.
What p=quarantine Does
A policy of quarantine asks receivers to treat failing mail as suspicious. In practice, almost every provider puts it in the spam or junk folder. The message is still delivered, so a legitimate email that failed by mistake can be found and recovered.
That makes quarantine a useful safety net while you tighten things up. If your reports missed a sender, its mail lands in spam rather than disappearing, and someone will usually notice and tell you. It also stops most spoofed mail from reaching the inbox, which is a real improvement over none.
The weakness is that spam folders still get read. Someone looking for a missing invoice or a password reset may find the fake one there and trust it, because it appears to come from your domain.
What p=reject Does
A policy of reject asks receivers to refuse failing mail during delivery. The sending server gets an error, the message is never placed in any folder, and the person it was addressed to never sees it. This is the only policy that fully stops someone from sending email that looks like it came from your domain.
Reject is also the clearest signal to mail providers that you take authentication seriously, which can help your legitimate mail reach the inbox. The risk is the same as its strength: if one of your own services is not set up correctly, its mail is rejected too, so you need to be confident everything passes before you switch.
Quarantine vs Reject: Which Should You Use?
For most domains, reject is the right final answer and quarantine is a stop along the way. Quarantine is better only while you are still unsure whether all of your legitimate mail passes, because mistakes end up in spam instead of vanishing.
Choose reject when your reports show that every service you use passes DMARC, when no unexpected failures have appeared for a couple of weeks, and when the domain is one people trust, such as the one you use for invoices, receipts or account emails. Those are exactly the domains scammers like to copy.
Stay at quarantine a little longer when you have recently added a new email tool, when your reports still show failures from servers you don’t recognize, or when you can’t yet tell whether a failing source is yours. Find out, fix it or rule it out, then move on.
How Long to Stay at Each Stage
There is no fixed rule, but a typical rollout for a small or medium business looks like this:
- Two to four weeks at p=none, reading reports and fixing SPF and DKIM for each service you find
- One to two weeks at p=quarantine, watching for any legitimate mail that lands in spam
- Then p=reject, with reports still turned on so you notice new problems
Large organizations with many sending systems often take several months, because each department may use its own tools. A domain with a single email provider and nothing else can often move to reject within a couple of weeks.
Testing a Stricter Policy Safely
The DMARC standard published in 2026 as RFC 9989 added a testing tag, t. A record with p=reject; t=y asks receivers to apply one step softer than the stated policy, so reject is treated like quarantine and quarantine is treated like none, while reports keep coming in. When you are confident, remove t=y and the full policy applies.
Older guides recommend the pct tag for this, such as pct=25 to apply the policy to a quarter of failing mail. That tag is no longer part of the standard, and newer receivers ignore it. If your record still has pct, remove it and use t=y instead if you want a testing period.
What Can Break When You Tighten the Policy
Most problems come from mail that is legitimately yours but doesn’t pass DMARC. A few situations cause nearly all of them.
Third-party services are the biggest one. A newsletter platform, CRM, payroll system or help desk that sends as your domain must either sign with DKIM using your domain or send through a server listed in your SPF record with a matching domain. Most of these services have a setup page for this, and your reports will show which ones are failing.
Forwarding and mailing lists are the other common cause. When a message is forwarded, SPF usually fails because the forwarding server isn’t in your record, and some mailing lists change the message in ways that break the DKIM signature. Many large providers use ARC, a way for forwarders to vouch for a message’s original result, to soften this, but it is the main reason to keep DKIM working on every message you send. DKIM signatures usually survive simple forwarding when SPF doesn’t.
Subdomains and the sp and np Tags
Your main policy also covers subdomains unless you say otherwise. The sp tag sets a separate policy for subdomains, and the np tag sets one for subdomains that don’t exist at all.
Be careful with sp=none. It is common in records copied from old examples, and it leaves every subdomain open to spoofing even when the main domain is at reject. Unless a subdomain has a specific reason to be different, leave sp out so it follows the main policy. Setting np=reject is a cheap extra step that stops scammers from inventing subdomains that have never existed.
What Mail Providers Require
The large mailbox providers set a minimum, not a goal. Google and Yahoo began requiring SPF, DKIM and a DMARC record of at least p=none from bulk senders in 2024, and Microsoft did the same for Outlook.com, Hotmail and Live addresses from May 5, 2025. Their thresholds are around 5,000 messages a day, so these rules mostly affect larger senders.
Meeting the minimum keeps your mail flowing, but p=none does nothing to stop someone else from impersonating you. The providers ask for none as the floor because it is safe for everyone to publish. Protection starts at quarantine.
Domains That Don’t Send Email
If a domain never sends mail, such as a parked domain or one held for a future project, there is no reason to start at none. Publish p=reject right away along with an SPF record of v=spf1 -all, which says no server may send for the domain. There is no legitimate mail to break, and unused domains are attractive to scammers precisely because nobody is watching them.
You can check any domain’s current policy with our DMARC Checker. It reads the record live, explains each tag and suggests the exact record for your next step, whether that is turning on reports, moving to quarantine or switching to reject.
Check Your DMARC Record
See your current policy, what each part does and the exact record to use next.