Skip to content
Back to Blog
DMARC.WS Team··6 min read

DMARC Policy: None vs Quarantine vs Reject — Which to Choose?

DMARCPolicyBest Practices

The Three DMARC Policies

The p= tag in your DMARC record is the most important setting. It tells receiving servers what to do with emails that fail authentication.

p=none (Monitor Only)

v=DMARC1; p=none; rua=mailto:reports@example.com

What happens: Failing emails are delivered normally. You only receive reports.

When to use:

  • You're just starting with DMARC
  • You need to discover all legitimate senders
  • You're still fixing SPF/DKIM issues

Pros:

  • Zero risk to email delivery
  • Full visibility through reports
  • Essential first step

Cons:

  • No protection against spoofing
  • Attackers can still impersonate your domain

Important: p=none is a monitoring policy, not a protection policy. Don't stay here forever.

p=quarantine (Soft Enforcement)

v=DMARC1; p=quarantine; rua=mailto:reports@example.com; pct=50

What happens: Failing emails are marked as suspicious — typically sent to the spam/junk folder.

When to use:

  • Your pass rate is above 95%
  • You've identified and fixed all legitimate senders
  • You want to start enforcement gradually

Pros:

  • Catches spoofing attempts
  • Failing emails aren't permanently lost (still in spam)
  • Low-risk transition step

Cons:

  • Legitimate misconfigured emails may go to spam
  • Some receivers interpret quarantine differently

Pro tip: Use the pct tag to roll out gradually. Start with pct=25 and increase over weeks.

p=reject (Full Enforcement)

v=DMARC1; p=reject; rua=mailto:reports@example.com

What happens: Failing emails are blocked entirely — they never reach the recipient.

When to use:

  • You've been on quarantine with high pass rates
  • All legitimate email sources are properly authenticated
  • You're ready for maximum protection

Pros:

  • Complete protection against domain spoofing
  • Required for BIMI (brand logos in email)
  • Strongest signal to email providers
  • Improves overall domain reputation

Cons:

  • Misconfigured legitimate emails will bounce
  • No recovery once rejected — the email is gone
  • Requires ongoing monitoring

The Migration Path

p=none → p=quarantine (pct=25) → p=quarantine (pct=100) → p=reject

Checklist Before Each Step

Before quarantine:

  • Pass rate above 95% for 2+ weeks
  • All known senders have SPF entries
  • DKIM is enabled for all email providers
  • No major authentication gaps in reports

Before reject:

  • Pass rate above 98% for 2+ weeks on quarantine
  • Zero legitimate senders failing authentication
  • Monitoring is in place and alerts are configured
  • Team is aware and has a process for adding new senders

What About Subdomains?

The sp= tag controls the policy for subdomains:

v=DMARC1; p=reject; sp=reject; rua=mailto:reports@example.com

Without sp=, subdomains inherit the p= policy. Explicitly setting sp=reject prevents attackers from spoofing anything.yourdomain.com.

Industry Stats

According to recent data:

  • ~50% of domains have no DMARC record at all
  • Of those with DMARC, ~60% are still on p=none
  • Only ~15% have reached p=reject
  • Domains with p=reject see 10x fewer spoofing attempts

Recommendations

  1. Never skip monitoring — even if you're confident, start with p=none
  2. Set a timeline — Don't stay on p=none indefinitely (4-8 weeks max)
  3. Use percentage rollout — The pct tag is your safety net during quarantine
  4. Monitor continuously — Even after reaching reject, keep watching reports
  5. Use a tool — DMARC.WS makes this entire journey easier