Home / Guides
DMARC policy explained: none, quarantine and reject
The p= tag decides what receivers do with mail that fails DMARC. Here is what each value does and when to use it.
The three policies
| Policy | What receivers do with failing mail | Use when |
|---|---|---|
p=none | Deliver as normal; only report | Starting out, gathering reports |
p=quarantine | Treat as suspicious, usually the spam folder | After legitimate sources pass |
p=reject | Refuse the message during SMTP | Full protection against spoofing |
Receivers treat the policy as a request, not a command. Large mailbox providers generally honour it, but they can apply local policy, for example quarantining instead of rejecting.
Related tags
- sp= sets the policy for subdomains that have no DMARC record of their own. If absent, subdomains inherit p=.
- pct= applies the policy to only a percentage of failing mail (default 100). The rest is treated one step lower: at
p=quarantine; pct=25, 75% of failing mail gets no action. Use it only as a temporary ramp. - rua= is where daily aggregate XML reports are sent. Without it you are enforcing blind.
- adkim= / aspf= set relaxed (r, default) or strict (s) alignment.
Example records
v=DMARC1; p=none; rua=mailto:dmarc@example.comv=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc@example.comv=DMARC1; p=reject; sp=reject; rua=mailto:dmarc@example.com
Moving from none to reject
- Publish
p=nonewith rua and collect at least 2-4 weeks of reports. - For every source in the reports that you recognise, make sure DKIM signs with your domain or SPF aligns. Unknown sources sending as your domain are what DMARC is meant to block.
- Switch to
p=quarantine. Optionally start at a lower pct and increase it. - When reports show only legitimate mail passing and nothing breaking, switch to
p=reject. - Keep monitoring: new tools added later are the most common cause of failures after enforcement.
What do Google and Yahoo require?
Bulk senders must publish a DMARC record; p=none satisfies the requirement. Enforcement (quarantine or reject) is also a prerequisite for BIMI logos.
Frequently asked questions
Is p=none useless?
No. It does not protect against spoofing, but it gives you reports and meets the Google/Yahoo minimum. It should be a stage, not the destination.
What is the difference between p and sp?
p applies to the domain that has the record; sp applies to its subdomains that do not publish their own record.
Related tools
Get alerted when it changes
Free daily monitoring re-checks SPF, DKIM, DMARC, MX, BIMI and MTA-STS and emails you when something changes or fails.
Set up free monitoring