DMARC p=none vs quarantine vs reject, which should I use?
By Ash, Founder, HosteazePublished 2 min read
The short answer
p=none tells receivers to deliver failing email as normal and just send you reports. p=quarantine sends failing email to spam. p=reject blocks it completely. Start at none, read the reports until every service you use passes, then move to quarantine and finally reject. Skipping straight to reject can block your own invoices.
Your DMARC record has one setting that matters more than the rest: the p= policy. It decides what happens to an email that claims to be from your domain but fails both SPF and DKIM. Think of it as a traffic light for anyone sending as you.
What does each DMARC policy do?
| Policy | What happens to failing email | Protects you from spoofing? | Risk to your own email |
|---|---|---|---|
p=none | Delivered as normal; you get reports | No | None |
p=quarantine | Sent to the spam or junk folder | Partly | Medium, if a sender isn't set up |
p=reject | Refused by the receiving server | Yes | High, if a sender isn't set up |
Receivers treat your policy as a strong request rather than a rule, so a few may still handle failing mail their own way. Gmail, Outlook and Yahoo broadly follow it.
Why not go straight to p=reject?
Because most businesses send email from more places than they realise. The booking system, the accounting software, the website contact form and the newsletter tool all send as your domain. If any of them isn't covered by SPF or DKIM, p=reject blocks their emails, and you only find out when a client asks where their invoice went.
p=none exists so you can find those senders first, without any risk.
What's a safe order to move through the policies?
- Publish
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.co.ukand wait for reports. You can check your DMARC record is live first. - Read the reports for two to four weeks. Fix every legitimate service that fails by adding it to SPF or switching on its DKIM.
- Move to
p=quarantine; pct=25. That applies the policy to a quarter of failing email, so a mistake only affects some messages. - Raise
pctto 100 over the following weeks while the reports stay clean. - Move to
p=reject, keeping therua=address so you still get reports.
The raw reports are XML files that aren't meant for human eyes. A free DMARC report reader turns them into a readable list of who is sending as you.
Which policy should a small business end up on?
p=reject, eventually. It's the only setting that stops scammers sending fake invoices in your name. But a business that's been sitting happily on p=none for a month is in a far better place than one that jumped to reject on day one and lost a week of email. For the full setup, see how to set up SPF, DKIM and DMARC.
Frequently asked questions
Is p=none enough for Gmail's requirements?
Yes, for now. Google's rules for senders of 5,000 or more emails a day require a DMARC record, and say the policy can be set to none. It does nothing to stop people impersonating you, though.
What does the sp= tag do?
It sets a separate policy for subdomains, such as mail.yourdomain.co.uk. If you leave it out, subdomains follow the main p= policy.
How long should I stay on p=none?
Until your reports show every legitimate service passing, which for most small businesses means at least two to four weeks so monthly emails like invoices and newsletters show up.
