DMARC p=none, quarantine or reject: Which Policy Should You Use?
6 min read • Updated November 2026
QUICK ANSWER
Start at p=none only long enough to collect reports, confirm legitimate senders pass SPF or DKIM alignment, then move to quarantine and later reject. p=none does not stop spoofing. p=reject is the goal for a mature domain, not the first step.
DMARC has three policies, and the difference is not cosmetic. p=none monitors, quarantine asks receivers to treat failing messages as suspicious, and reject asks them to refuse them. Choosing the wrong step can either leave your domain spoofable or block legitimate invoices and password resets.
This guide is the rollout order we recommend: authenticate the legitimate senders first, collect reports, then tighten the policy. It is not legal advice, and it cannot replace looking at your own mail stream.
What each policy does
p=none means “report failures but deliver them.” It is a monitoring mode. It does not prevent someone from spoofing your domain. p=quarantine means “treat failing mail as suspicious,” commonly spam or a separate folder. p=reject means “refuse failing mail.”
DMARC also has sp= for subdomains and pct= for partial enforcement. A policy with pct=25 applies the requested action to roughly 25% of failing mail, which can be useful for a controlled rollout but is not full protection.
The safe rollout order
First publish p=none with a rua= reporting address. Confirm that every legitimate sender is authenticated by SPF or DKIM alignment. Fix the failures before tightening. When reports are clean, move to p=quarantine with pct=25 or 50, observe, then reach 100%.
After quarantine has been stable, move to p=reject. Keep reporting enabled. A mature domain should not stay at p=none indefinitely unless it is intentionally only monitoring a low-volume or experimental domain.
How to read aggregate reports
DMARC aggregate reports are XML summaries from receivers. Look at the source IP, the sending domain, SPF and DKIM alignment, the disposition and the message count. Legitimate services show up as failed if their envelope or header domains do not align, even when SPF itself passes.
Do not treat a single failing IP as an attack. It may be a new CRM, a ticketing system or a transactional provider that needs its own authenticated subdomain. Add or fix the legitimate sender first; block or reject only after you understand it.
When to use a subdomain policy
Marketing, transactional and internal mail often use different sending services. A subdomain such as mail.example.com can have its own SPF, DKIM and DMARC policy while the root domain stays conservative.
A root p=reject does not necessarily enforce the same policy on every subdomain. Check sp= and the subdomain’s own _dmarc record. Keep the authentication scope aligned with the actual From domain.
What not to do
Do not switch to p=reject on day one because a blog post said so. Do not publish multiple DMARC records. Do not use p=none and call the domain protected. Do not ignore reports and assume “no complaints” means “no failures.”
Do not use this guide as a substitute for a real test message and Authentication-Results headers. DNS says what should happen; a delivered message shows what did happen.
QUICK TIPS
- ✓ Keep rua= reporting on at every stage.
- ✓ Authenticate every legitimate sender before tightening the policy.
- ✓ Use pct= for a controlled move from none to quarantine.
- ✓ Check subdomains and sp= separately from the root policy.
- ✓ p=reject is the destination, not the starting line.
Frequently asked questions
Should I start DMARC at p=reject?+
Does p=none protect my domain from spoofing?+
What does pct=50 mean?+
Do I need DMARC on subdomains?+
Sources and further reading
Cite this page: Clipaist Editorial, "DMARC p=none, quarantine or reject: Which Policy Should You Use?", Clipaist, November 2026. https://clipaist.com/guides/dmarc-policy-none-quarantine-reject/
Clipaist Editorial
We test every AI tool and prompt before publishing. Questions or corrections? Reach us on the Contact page.