DMARC p=none vs quarantine vs reject: which policy should you use?
The p= tag in your DMARC record tells every mailbox provider in the world what to do with a message that claims to be from your domain but fails authentication. none means "just report it to me," quarantine means "spam-folder it," reject means "refuse it outright." Getting from none to reject safely is the whole game of DMARC deployment.
Updated July 13, 2026
p=none — monitoring mode
Nothing changes about delivery: spoofed mail still lands, failing mail still arrives. What you gain is visibility — receivers start sending you aggregate reports listing every server sending as your domain and whether it authenticated. p=none is the correct starting point, because you almost certainly have legitimate senders you've forgotten about, and an enforcing policy would silently break them.
The failure mode of p=none is staying there forever. It provides zero protection — it's a flight recorder, not a lock. Plan to be at enforcement within a few months, not years.
p=quarantine — the spam-folder policy
Failing mail goes to spam instead of the inbox. Real users rarely check spam, so this blocks most practical phishing — while leaving a recovery path if you misconfigured a legitimate sender. You can ramp gradually with pct=: p=quarantine; pct=25 applies the policy to a quarter of failing mail while you watch the reports.
p=reject — full enforcement
Failing mail is refused during delivery — the spoofed message never reaches the user in any folder, and the sender gets a bounce. This is the end state, the policy PCI DSS 4.0 auditors look for, and the only p= value that fully takes your domain off the table for spoofing.
How to move up without breaking real mail
- Publish p=none with a rua= reporting address (our DMARC generator builds the record).
- Collect 2–4 weeks of reports. Identify every legitimate source and fix its SPF or DKIM alignment.
- When aligned volume approaches 100% of legitimate mail, move to p=quarantine — with pct= if you want a gradual ramp.
- After 2–4 quiet weeks at quarantine, move to p=reject.
The judgment call in step 3 — "is everything legitimate actually aligned?" — is exactly what HealthCheck Email's enforcement-readiness simulator computes from your real report data, so you move up when the numbers say it's safe rather than when you feel brave.