DMARC p=none vs quarantine vs reject: Which Policy Should You Use?

DMARC policy is not the same as authentication

DMARC evaluates whether SPF or DKIM passes in alignment with the visible From domain. The p= tag then tells receiving systems what policy you are requesting for messages that fail that evaluation.

A stricter policy does not repair broken authentication. Fix legitimate sending sources before relying on enforcement.

p=none: monitoring

A p=none policy asks receivers to take no DMARC-specific enforcement action. It is commonly used while organizations collect aggregate reports and discover all legitimate sending services.

Monitoring is valuable, but leaving a mature domain at p=none indefinitely provides less direct protection against spoofed mail than an enforcement policy.

p=quarantine: treat failures suspiciously

Quarantine asks receivers to treat DMARC failures as suspicious, often by placing them in spam or applying additional filtering. Receivers retain final control over how they interpret the request.

Use quarantine when you understand the majority of your mail flow but still want a less absolute step before rejection.

p=reject: strongest requested enforcement

Reject asks receivers not to accept messages that fail DMARC. It offers stronger spoofing protection when the legitimate ecosystem is fully mapped and aligned.

Before moving to reject, test websites, SaaS tools, CRM systems, support platforms, marketing senders and any third party that sends as your domain.

Use percentage and subdomain controls carefully

DMARC provides additional tags such as pct and sp that can support staged deployment and subdomain policy. Use them deliberately and confirm how your receiving and reporting ecosystem interprets them.

The safest progression is evidence-driven: monitor, fix, increase enforcement, then continue reviewing reports for new or changed sending sources.