DMARC p=none vs p=quarantine vs p=reject: Which Should You Use?
DMARC has three enforcement levels, and picking the wrong one — or jumping straight to the strictest — is how teams accidentally block their own legitimate email. Here’s how to choose correctly.
The three policies
p=none — monitor only
Nothing gets blocked. Messages that fail SPF/DKIM alignment are delivered as normal, but if you’ve set up rua reporting, you receive aggregate reports showing exactly which sources are sending mail as your domain — including services you forgot about and, potentially, spoofers.
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.comp=quarantine — flag suspicious mail
Messages that fail alignment get delivered to spam/junk instead of the inbox, rather than being rejected outright. This is the “training wheels” stage — it reduces the damage from misconfiguration while you finish fixing legitimate senders.
p=reject — full enforcement
Messages that fail alignment are rejected at the mail server, before they reach a mailbox at all. This is the only policy that actually stops domain spoofing and business email compromise using your domain. It’s also the only policy that unlocks full brand protection in inboxes that support it.
The rollout path that actually works
- Start at p=none for at least 1-2 weeks. Read the aggregate reports. You will almost always find at least one legitimate sender (an invoicing tool, a CRM, a marketing platform) that isn’t properly authenticated yet.
- Fix SPF and DKIM for every legitimate source the reports surface, until they show consistent “pass” alignment.
- Move to p=quarantine, often starting with a percentage rollout using
pct=, e.g.p=quarantine; pct=25, then increasing over a few weeks. - Move to p=reject once quarantine reports stay clean.
Common mistake: skipping straight to reject
Jumping directly to p=reject without reviewing reports first is the single most common cause of “our invoices stopped arriving” incidents. Any sending source you haven’t authenticated — including ones sending on your behalf that you may not control directly — gets silently dropped.
Don’t forget alignment
DMARC doesn’t just check that SPF or DKIM pass — it checks that the passing domain aligns with the visible From: address. A message can pass SPF for a third-party sending domain and still fail DMARC if that domain doesn’t match yours (in relaxed or strict mode). This is the part most misconfigurations trip over, not the policy setting itself.