Skip to content
Hookgap
Get started

DMARC p=none vs quarantine vs reject, in plain English

· 5 min read

DMARC is a short DNS record at _dmarc.yourdomain.com that tells mail providers two things: how to check whether an email claiming to be from your domain is genuine, and what to do if it is not. The "what to do" part is the policy, the p= tag.

The three policies

  • p=none: monitor only. Providers check messages and can send you reports, but fake email is still delivered as normal. Useful as a first step; it does not protect anyone.
  • p=quarantine: send fakes to spam. Messages that fail DMARC go to the junk folder. Real protection, with a safety net while you finish setup.
  • p=reject: block fakes. Failing messages are refused outright. This is the goal for most business domains.

No DMARC record at all behaves much like p=none, but without any reporting: nobody can see who is sending email in your name.

What "failing DMARC" means

A message passes DMARC when SPF or DKIM passes and the domain that passed matches (aligns with) the domain in the visible From address. A fake invoice "from" accounts@yourfirm.com sent from someone else's server fails both checks, so DMARC applies your policy to it.

Other tags you will see

  • rua=mailto:…: where daily summary reports go. Always set this; reports are how you find your legitimate senders.
  • pct=50: apply the policy to only part of the failing mail. Handy while ramping up, but remember to return to 100.
  • sp=: the policy for subdomains. If it's absent, subdomains inherit p=.
  • adkim=s / aspf=s: strict alignment (exact domain match) instead of relaxed (any subdomain).

Paste any record into the DMARC record explainer to see what each tag means.

A safe path from none to reject

  1. Publish p=none with a rua address, ideally through a DMARC reporting service that turns the raw XML reports into a readable list of senders.
  2. Watch for two to four weeks. List every service that legitimately sends as the domain: your mail platform, CRM, newsletter tool, billing system, website forms.
  3. Fix each sender so it passes SPF or, better, DKIM on your domain.
  4. Move to p=quarantine (optionally starting with pct=25 and raising it), then keep watching reports.
  5. Move to p=reject once reports show only legitimate mail passing and only fakes failing.

Skipping straight to reject without step 2 is how real invoices and password resets get blocked. Staying on none forever is how the domain stays open to spoofing.

Where most small businesses are

In our sample of 64 local professional firms, 41 had no DMARC record and 15 were on p=none. Only 8 enforced a policy. See what 64 local firms' DNS tells us.

Keep reading