DMARC Policies: p=none vs. quarantine vs. reject

DMARC policies tell receiving mail systems how to handle messages that fail DMARC checks for a domain. p=none requests monitoring, p=quarantine asks receivers to treat failing mail as suspicious, and p=reject asks them to reject it. The right policy depends on whether every legitimate sender is identified and authenticated.

What the three policies mean

With p=none, the domain owner can observe authentication results without requesting quarantine or rejection. It is useful during discovery, but it does not protect recipients from unauthenticated messages by itself.

p=quarantine asks receiving systems to treat failing mail as suspicious, often by placing it in spam. p=reject requests that failing messages be refused. Receivers make the final delivery decision, so the policy is a signal, not a guarantee that every provider behaves identically.

• Monitor all legitimate sending sources before enforcement.
• Check SPF and DKIM alignment with the visible From domain.
• Account for subdomains and third-party sending services.

Move from monitoring to enforcement carefully

Inventory every system that sends as your domain: employee mail, marketing platforms, billing notifications, support tools, and vendors. Review aggregate reports to distinguish authorized sources from spoofing and misconfigured senders. Fix legitimate sources before tightening the policy.

A staged rollout reduces the chance of blocking important mail. Teams often begin in monitoring, correct alignment and DNS issues, then move to quarantine and stronger enforcement after observing stable results. The pace should reflect message volume and how quickly the organization can review reports.

• Document the owner and purpose of each sender.
• Retest after changing providers, DKIM keys, or SPF records.
• Keep a rollback plan for a legitimate source that fails unexpectedly.

Treat the policy as part of ongoing operations

DMARC should be reviewed when vendors or domains change, not set once and forgotten. Ensure the organizational domain and any subdomain policy reflect actual sending practices. A strict policy without a complete sender inventory can disrupt legitimate communications.

Policy enforcement can reduce some forms of domain spoofing, but it does not prevent every phishing method or secure compromised accounts. Pair it with account security, provider controls, and a process for handling authentication changes.