DMARC Policy: None vs. Quarantine vs. Reject (and When to Move Up)
Understanding a DMARC policy none vs quarantine setup is the first step to actually protecting your business email domain from impersonation. DMARC has three distinct policy levels that tell receiving mail servers what to do with unauthorized emails. A policy of none simply monitors traffic, quarantine sends failing emails to the spam folder, and reject blocks unauthorized emails entirely.
Many business owners set up DMARC to meet basic vendor requirements or comply with new sender rules, but they leave their record in monitoring mode. While starting at a policy of none is the correct way to deploy email authentication, staying there permanently leaves your domain completely vulnerable to spoofing.
This guide explains what each policy level does, why you cannot stay in monitoring mode forever, and how to safely move your business to full enforcement without breaking your legitimate email delivery.
Key Takeaways
Three policy levels: monitor, quarantine, block. p=none delivers everything regardless of authentication. P=quarantine routes failing messages to the spam folder. P=reject stops unauthorized email entirely.
p=none offers zero protection against spoofing. it exists solely to gather reports while you identify your legitimate senders.
Quarantine is your safety net during the transition. A misconfigured legitimate sender lands in spam instead of being blocked outright.
The “DMARC policy not enabled” warning simply means p=none. Your record is present but not enforcing protection. Once you upgrade to enforcement, the warning disappears.
The Three DMARC Policy Levels Explained
DMARC (Domain-based Message Authentication, Reporting, and Conformance, defined in RFC 7489) ties your other email protocols together. To understand what DMARC does, you have to look at alignment. DMARC alignment requires the domain in the visible from address to match the domain validated by SPF or DKIM. When an email fails this alignment check, your published DMARC policy tells the receiving server how to handle the message.
Here is how the three policy levels compare when you look at DMARC none vs quarantine vs reject:
| Policy | Action on Failed Mail | Protection Against Spoofing | Primary Use Case | Risk to Legitimate Mail |
|---|---|---|---|---|
| None (p=none) | No action. Messages are delivered normally to the recipient inbox. | Zero. Spoofed email reaches its target. | Monitoring mode. You collect reports on your senders. | None. All mail is delivered. |
| Quarantine (p=quarantine) | Messages are treated as suspicious and routed to the spam or junk folder. | Partial. Failing mail is flagged and kept out of the inbox. | First level of enforcement. A safety net during your transition. | Low. A misconfigured legitimate sender lands in spam but still reaches the recipient. |
| Reject (p=reject) | Messages are rejected outright, ideally at the SMTP transaction level. | Maximum. Unauthorized email is blocked entirely. | Full enforcement once every legitimate sender passes alignment. | High if you skip the audit. A misconfigured legitimate sender is blocked completely. |
Here is what each policy tier looks like as an actual DNS TXT record:
- None:
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com - Quarantine:
v=DMARC1; p=quarantine; pct=50; rua=mailto:dmarc-reports@yourdomain.com - Reject:
v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourdomain.com
The rua= tag tells receiving servers where to send your aggregate reports. Swap in your own reporting address.
To update your policy, log into your DNS hosting provider, locate the TXT record at _dmarc.yourdomain.com, and change the p= tag. The exact steps vary by provider (GoDaddy, Cloudflare, and Microsoft 365 all have different interfaces), but the record syntax is the same everywhere.
Why Everyone Starts at None (And Why You Cannot Stay There)
Every proper DMARC deployment begins with a policy of p=none. When you publish this record, you instruct receiving mail servers to start sending you DMARC rua ruf reports. Aggregate (RUA) and forensic (RUF) reports show exactly which IP addresses and services are sending email on behalf of your domain.
You need this data because modern businesses send email from many places. Your CRM, marketing software, it ticketing system, and billing platform all send mail as your domain. If you do not know exactly who is sending your mail, you cannot authorize them properly.
Staying at p=none permanently defeats the purpose of having DMARC. A policy of none offers zero protection against cybercriminals. If a scammer sends a fake invoice from your exact domain name, a p=none policy explicitly tells the receiving server to deliver that fake email right to the target inbox.
Recent industry mandates have pushed adoption forward. Google and Yahoo both began enforcing bulk sender requirements in February 2024. For basic compliance with these rules, a policy of p=none is technically acceptable. But the DMARC policy best practice for business is to move up to actual protection.
Starting February 1, 2024, Google requires bulk senders to authenticate with SPF and DKIM and publish a DMARC record. Senders must keep spam rates below 0.10 percent, avoid reaching 0.30 percent or higher, and support one-click unsubscribe. This applies to anyone sending close to 5,000 or more messages per day to personal Gmail accounts within a 24-hour period. Yahoo began enforcing similar requirements the same month.
The Safe Path to Quarantine and Reject
You want to block scammers without accidentally breaking your own marketing or billing emails. Here is how to move from DMARC none to quarantine, and eventually to reject.
1. Audit Your DMARC Reports
While in monitoring mode, review your aggregate reports. Identify every legitimate service sending mail as your business. You will likely find third-party tools you forgot about.
2. Fix SPF and DKIM Alignment
Before you change your policy, you must ensure all legitimate senders pass DMARC alignment. DMARC alignment requires the domain in the From address to match the domain validated by SPF (the envelope sender) or DKIM (the signing domain). Configure SPF and DKIM correctly for every tool you use.
SPF has a hard 10-DNS-lookup limit. SPF (Sender Policy Framework, RFC 7208) imposes this limit during evaluation. Exceeding 10 lookups causes a PermError, which receiving servers may treat as a fail.
DKIM signs messages cryptographically. DKIM (DomainKeys Identified Mail, RFC 6376) lets a sending domain sign a message using a private key. You must ensure the public key is published correctly in your DNS.
Most businesses stay with relaxed alignment. The aspf= and adkim= tags control how strictly SPF and DKIM alignment is enforced. Relaxed (the default) accepts subdomain matches like mail.example.com for example.com. Strict requires an exact domain match. Stick with relaxed unless your sending infrastructure is unusually flat and you need the tighter control.
3. Stage Your Rollout with the PCT Tag
You do not have to enforce your policy on your entire mail stream overnight. Use the DMARC pct tag to roll out enforcement gradually. The pct tag is a plain-text integer from 0 to 100 (default 100) that controls the percentage of your mail stream subject to the published policy.
By setting a lower integer, you apply the policy to a fraction of your mail stream. This lets you watch the impact before scaling up to 100. Messages not selected for reject due to pct sampling should be treated as though a quarantine policy applies.
Example: p=quarantine; pct=50 applies quarantine to half your mail stream while you monitor the reports. Once you are confident nothing legitimate is breaking, raise it to pct=100.
4. Move to Reject
When to use DMARC reject? Move to p=reject only after you have monitored a quarantine policy at a pct of 100 for several weeks and confirmed that no legitimate business emails are failing authentication.
Ready to Move Up? A Quick Self-Check
Answer the questions below with your reports in hand, and the right policy level picks itself.
| Ask yourself | If no | If yes |
|---|---|---|
| Have you audited your aggregate (RUA) reports and identified every legitimate service sending mail as your domain? | Stay at p=none and keep reviewing reports. | Move on to fixing alignment. |
| Does every legitimate sender pass DMARC alignment through a correctly configured SPF or DKIM record? | Stay at p=none until your records are fixed. | You are ready for p=quarantine. |
| Has p=quarantine run at a pct of 100 for several weeks with no legitimate business emails failing authentication? | Stay at quarantine and keep monitoring. | You are ready for p=reject. |
What Breaks When You Enforce Too Fast
Business owners often ask about the risk of a DMARC p=reject vs p=quarantine policy. Jumping straight to reject without auditing your sending sources will break your own email delivery.
Marketing platforms can fail DKIM. If your marketing platform lacks proper DKIM configuration, those emails will fail DMARC checks. Under reject, your newsletters are blocked entirely. Under quarantine, they land in spam.
Billing software can fail SPF. If your billing platform uses an unaligned SPF record, customer invoices will not pass DMARC. Reject means blocked. Quarantine means junk folder.
Here is what each failure mode looks like under each policy:
| Failure Mode | Under p=quarantine | Under p=reject |
|---|---|---|
| Marketing platform (DKIM misconfigured) | Newsletters land in spam folder. Recipient can still find them. | Newsletters are blocked entirely. No delivery. |
| Billing software (SPF unaligned) | Invoices land in spam. Recipient still receives them. | Invoices are blocked. Customer never sees them. |
| Customer-facing email (any sender misconfigured) | Email lands in spam. Available if the recipient checks. | Email is rejected at SMTP level. Completely silent failure. |
This is why understanding the DMARC policy quarantine meaning is so important. Quarantine acts as a safety net during your transition. It protects your domain from obvious spoofing while ensuring that if you made a mistake configuring a legitimate sender, the email still reaches the recipient (even if it lands in the junk folder).
Enforcing your policy also protects your domain reputation. If you stay at none, scammers freely spoof your domain using malicious IP addresses. Receiving servers may start associating your domain name with bad IPs, such as those listed on the Spamhaus ZEN blocklist. ZEN merges the SBL, CSS, XBL, and PBL into a single list. An IP listed in ZEN is typically rejected during the SMTP connection phase. Stopping spoofers with a reject policy keeps your domain away from these bad associations.
The “DMARC Policy Not Enabled” Warning Explained
This warning causes a lot of confusion for business owners. It does not mean your DMARC record is broken or missing. It simply means your domain has a valid DMARC record, but the policy is currently set to p=none. The tool is warning you that you are not actively enforcing protection.
Once you update your record to an enforcement level, that warning will disappear. To fix it, work through the four steps above:
- Audit your aggregate reports to identify all senders.
- Fix SPF and DKIM alignment for every service.
- Stage your rollout with the pct tag.
- Move to quarantine or reject once you confirm nothing legitimate is breaking.
You can use the free SPF, DKIM, and DMARC domain check to verify your exact status.
See Where You Stand
Free Email Domain Security Grader: enter your domain, we check your real SPF, DKIM, and DMARC records and grade your spoofability in seconds with our free SPF, DKIM, and DMARC domain check
Related Guides
- SPF, DKIM & DMARC Record Check: Test and Fix Your Domain
- How to Stop Email Spoofing of Your Business Domain
- Business Emails Going to Spam? Blacklists and Auth Fixes
Frequently Asked Questions
What is the difference between DMARC none and quarantine?
A policy of none is a monitoring mode that allows all emails to be delivered normally even if they fail authentication. A quarantine policy is an enforcement mode that instructs receiving servers to send failing emails to the recipient’s spam or junk folder.
Should I use DMARC quarantine or reject?
You should start with quarantine to ensure your legitimate emails are not accidentally blocked due to configuration errors. Once you verify through reporting that all your authorized senders are passing DMARC checks, you should move to a reject policy for maximum security.
What does p=none mean in DMARC?
The p=none tag instructs receiving mail servers to take no action against emails that fail authentication checks. It allows domain owners to receive daily reports on email traffic without risking the delivery of their legitimate business messages.
Is DMARC p=none doing anything?
It generates valuable aggregate and forensic reports that show you who is sending email as your domain. However, it does absolutely nothing to stop cybercriminals from spoofing your domain and sending fake emails to your clients.
How long should I stay at DMARC p=none?
You should stay at a policy of none only as long as it takes to identify your legitimate sending sources and configure their SPF and DKIM records properly. For most small to medium businesses, this process takes a few weeks to a few months.
What happens when DMARC is set to quarantine?
When an email fails DMARC alignment under a quarantine policy, the receiving mail server treats the message as suspicious. The email is typically routed away from the inbox and placed directly into the spam or junk folder.
Does DMARC p=none prevent spoofing?
No. A policy of none explicitly tells receiving servers to deliver unauthorized emails normally. To actually prevent spoofing, you must upgrade your policy to quarantine or reject.
What does sp=none mean, and is my subdomain protected if my main domain is set to reject?
The sp= tag sets a separate policy specifically for your subdomains. If you do not publish an sp= tag at all, your subdomains automatically inherit whatever your main p= policy is, so a p=reject domain protects its subdomains by default. But if someone explicitly sets sp=none while the main domain is p=reject, that subdomain is left completely open to spoofing even though the root domain is fully locked down. If your business uses subdomains for marketing, ticketing, or other services, check that any sp= tag matches the protection level you actually want.
Is DMARC mandatory now?
Yes, if you send bulk email. Google and Yahoo both require a published DMARC record as of February 2024 for anyone sending close to 5,000 or more messages a day to their users, alongside SPF and DKIM authentication. For that baseline compliance, a policy of p=none is technically enough. But meeting the minimum requirement and actually protecting your domain from spoofing are two different things: p=none satisfies the rule while leaving you fully exposed.
Why is my DMARC check failing, and how do I fix it?
A DMARC failure almost always traces back to one of two problems: the domain in your visible From address does not match the domain validated by SPF, or it does not match the domain that signed the message with DKIM. Start by reviewing your aggregate reports to see which sending sources are failing. Then check that each one has a correctly configured SPF record (and has not pushed you over the 10-lookup limit) or a properly published DKIM key. Once every legitimate sender passes alignment, the failures stop.
Secure Your Business Email
Implementing email authentication correctly requires careful monitoring and strict attention to DNS configurations. LeadingIT helps Illinois businesses navigate this process safely through LeadingIT’s managed cybersecurity services. Since 2010, we have supported roughly 200 organizations and over 2,500 users from our Woodstock and Manteno offices. If you need help securing your domain, book a call or contact us at 815-788-6041.
