DMARC policy: p=none vs quarantine vs reject

Updated October 25, 2026

A DMARC policy is the p= value in your _dmarc TXT record. It tells receiving mail servers what you want done with messages that fail DMARC: none (deliver as normal and report), quarantine (treat as suspicious) or reject (refuse the message).

DMARC policies compared
Policy	What receivers do with failing mail
`p=none`	Nothing different. Mail is delivered as if DMARC did not exist; you get reports.
`p=quarantine`	Treat as suspicious, usually the spam folder.
`p=reject`	Refuse the message. The recipient never sees it.

What does p=none do?

p=none tells receivers you have no preference about failing mail, so they handle it as they would without DMARC. Spoofed messages are not blocked. Its value is visibility: with a rua= address set, receivers send you aggregate reports listing every server that sent mail as your domain and whether it passed.

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

RFC 9989 defines none as "The Domain Owner offers no expression of preference." (RFC 9989)

What does p=quarantine do?

p=quarantine asks receivers to treat mail that fails DMARC as suspicious. In practice that usually means delivery to the spam or junk folder rather than the inbox. It protects recipients from spoofed mail while leaving a recovery path if one of your own senders is misconfigured, because the message still arrives somewhere.

v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com

Google describes quarantine as sending failing messages to the recipient's spam folder. (Google)

What does p=reject do?

p=reject asks receivers to refuse mail that fails DMARC, usually during delivery, so the message is never placed in any folder. It is the strongest protection against someone sending as your domain. The trade-off is that a misconfigured legitimate sender also loses its mail, with no copy in spam to find later.

v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com

RFC 9989 says reject means the domain owner considers failures "a clear indication that the use of the domain name is not valid." (RFC 9989)

Which DMARC policy should I use?

Use p=none only while you find out who sends mail as your domain. Once reports show every legitimate source passing SPF or DKIM with alignment, move to p=quarantine and then p=reject. A domain that never sends email can go straight to p=reject.

New domain, still adding tools: p=none with rua, reviewed weekly.
All senders known and passing: p=quarantine, then p=reject.
Parked or non-sending domain: p=reject, plus an SPF record of v=spf1 -all. (Microsoft Learn)
Cold email sending domain: at least p=none with rua, since that is the major providers' minimum for bulk senders. See cold email domain setup.

How do I move from p=none to p=reject safely?

Google's recommended rollout is: set up SPF and DKIM at least 48 hours before DMARC, run p=none for about a week while reviewing reports, then switch to p=quarantine for a small percentage of mail and raise it to 100%. After that you can move to p=reject the same way. (Google)

Publish SPF and DKIM for every sending service. Confirm with the checker.
Publish p=none with a rua address and review reports for at least a week.
Fix any legitimate source that fails: add it to SPF, or better, set up DKIM signing with your domain.
Move to p=quarantine. Google's example starts small organizations at 10% and large ones at 1%, raising the percentage over time.
When quarantine covers all mail with no surprises in the reports, move to p=reject.

What happened to pct?

RFC 9989, published in May 2026, removes the pct tag that set what percentage of failing mail the policy applied to. In its place is t=y, a test mode that asks receivers to apply one level less strict than the stated policy, so p=reject; t=y behaves like quarantine. (RFC 9989)

Receivers adopt new standards gradually, and Google's rollout guide still describes pct. Both RFC 7489 and RFC 9989 tell receivers to ignore tags they do not recognize, so during the transition you can publish both without breaking anything:

v=DMARC1; p=quarantine; pct=10; t=y; rua=mailto:dmarc-reports@example.com

Remove both once you are at full enforcement.

What do DMARC reports tell me?

Aggregate reports, sent to the rua address, are XML files from each receiver that list the IP addresses that sent mail using your domain, how many messages each sent, and whether SPF, DKIM and alignment passed. They contain no message content. They are how you find senders you forgot about before you enforce.

Raw XML is hard to read, so most people send rua to a DMARC reporting service. If that service is on another domain, it must publish an authorization record at yourdomain._report._dmarc.theirdomain, or receivers will not send it your reports. (RFC 9990, section 4) The checker tests this for you.

What policy do Gmail, Yahoo and Outlook require?

All three require bulk senders to publish DMARC with at least p=none, and for the From: domain to align with SPF or DKIM. Google and Yahoo define bulk as more than 5,000 messages a day to their users; Microsoft applies the same threshold to Outlook.com, Hotmail.com and Live.com since May 5, 2025.

None of them currently require quarantine or reject. (Google, Yahoo, Microsoft)

See what your domain publishes today: run the DMARC check.

Frequently asked questions

Will p=reject hurt my deliverability?

Not for mail that passes DMARC. The policy only applies to messages that fail, so the risk is a legitimate sender you forgot to authenticate, such as a billing system or a newsletter tool. Aggregate reports show those senders before you enforce.

Is p=none useless?

No. It does not block spoofed mail, but it turns on reporting and meets the minimum that Gmail, Yahoo and Outlook.com require from bulk senders. It is the right first step, not the place to stay. (Google, Yahoo)

Can I go straight to p=reject?

Only if you are certain every service that sends as your domain passes SPF or DKIM with alignment. For a domain that never sends mail, yes: p=reject is the right choice from day one. For an active domain, monitor with p=none first.

What is the difference between quarantine and reject?

Quarantine asks receivers to treat failing mail as suspicious, which in practice usually means the spam folder. Reject asks them to refuse it outright, so the recipient never sees it. Google notes that with reject, failing messages are never delivered. (Google)

Does my DMARC policy cover subdomains?

Yes, by default. Subdomains without their own _dmarc record inherit the parent's p= value unless you set sp= for subdomains. RFC 9989 adds np= for subdomains that do not exist at all. (RFC 9989)

How often are DMARC reports sent?

Aggregate reports are requested once a day by default: RFC 7489 sets the default report interval (ri) to 86,400 seconds. Each receiver sends its own report, so expect several files a day once volume picks up. (RFC 7489)