DMARC p=none vs p=quarantine vs p=reject

What it is

p=none tells receivers to take no action on failing mail — it only monitors and sends you reports. Your domain is still fully spoofable at p=none.

p=quarantine tells receivers to treat failing mail as suspicious — usually delivering it to the spam folder.

p=reject tells receivers to refuse failing mail outright. This is full protection: impersonation is blocked before it reaches the inbox.

Why it matters

Most domains publish p=none and stop — which means they get the compliance checkbox but none of the protection. Criminals can still send perfect look-alike mail from your domain.

Enforcement (reject) is the whole point of DMARC. The reason to move up carefully, not instantly, is to make sure you don't block your own legitimate mail on the way.

How to set it up

1. 1Start at p=none with a rua= reporting address and collect at least a couple of weeks of reports.
2. 2Review the reports (or paste one into our report analyzer) and confirm every legitimate sender passes DMARC alignment — fix the ones that don't.
3. 3Move to p=quarantine, optionally with pct=25 then higher, to roll out gradually and watch for surprises.
4. 4Once quarantine is clean, move to p=reject. Keep the reporting address so you keep seeing spoofing attempts being blocked.

Common problems

Is p=none safe to leave in place?

It's safe for your mail, but it gives you zero protection — anyone can still spoof your domain. Treat p=none as a temporary data-gathering step, not a destination.

Will p=reject block my legitimate email?

Only if a real sender of yours isn't aligned. That's exactly what the p=none reporting phase is for — fix every legitimate sender first, and reject only blocks the impersonators.

What's pct= for?

It applies your policy to only a percentage of failing mail (e.g. pct=25), so you can ramp enforcement gradually. Drop it (or set 100) once you're confident.

More guides