DMARC Policy Levels: What None, Quarantine and Reject Do
A dmarc policy is one line of DNS that answers a question every mail receiver on the internet is silently asking about your domain: when a message claims to be from you but can't prove it, what would you like done with it? The three possible answers - p=none, p=quarantine, p=reject - are frequently described as "off, medium, high", which mangles what each actually does. None is not off, quarantine is not a suggestion-strength reject, and reject protects your brand while occasionally costing you real mail if deployed carelessly.
This guide covers what a DMARC policy evaluates, precisely what each level instructs receivers to do, and the supporting tags that shape how the instruction is applied.
What a dmarc policy actually judges
The record lives at _dmarc.yourdomain.com as TXT, minimally v=DMARC1; p=none;. A message passes DMARC when at least one of two things is true: SPF passes and the domain it passed for aligns with the visible From domain, or a DKIM signature verifies and its signing domain aligns with the From domain. One aligned pass suffices; two failures - or passes on unaligned domains, like a platform's bounce domain - mean DMARC fails, and your policy tells the receiver what that failure should cost the message.
Alignment is the entire point. SPF and DKIM alone can both "pass" on domains the recipient never sees; DMARC is the protocol that drags authentication back to the address a human actually reads. Which is also why the policy judges spoofers and your own misconfigured senders with perfect impartiality - a forgotten newsletter tool that never got DKIM keys fails exactly like a phisher, and the policy costs both of them the same delivery.
The three levels, precisely
| Policy | Instruction to receivers | Your legit-but-broken mail | A spoofer's mail |
|---|---|---|---|
p=none |
Deliver normally; send me reports | Delivered as always | Delivered as always |
p=quarantine |
Treat failures as suspicious - typically the spam folder | Lands in spam until fixed | Lands in spam |
p=reject |
Refuse failures outright at SMTP | Bounces until fixed | Never delivered |
p=none changes nothing about delivery, and calling it "DMARC in name only" undersells it twice. First, it switches on the reporting stream (below), which is the only instrument that shows you every system sending as your domain - the inventory you cannot safely tighten without. Second, published requirements now ask for it explicitly: Google's bulk-sender rules require at least p=none, so the minimal record went from optional to table stakes in 2024.
p=quarantine asks receivers to treat failing mail as suspect. In practice that means the spam folder at Gmail and most large providers, though the standard leaves the mechanism to the receiver - some corporate gateways hold messages for review instead. The failure mode is soft: a misconfigured sender's mail still exists, in the wrong folder, findable once someone looks.
p=reject instructs receivers to refuse the message during delivery. The sender gets a bounce; the recipient never sees anything. This is the only level that actually stops spoofed mail rather than demoting it, which is why it is the destination for any domain that matters - and it is also the level where a misconfigured legitimate sender stops delivering entirely, which is why the road there runs through none-plus-reports first.
One nuance on enforcement: policies are instructions, not physics. Receivers overwhelmingly honor them, but a receiver may override - delivering a known-good forwarded message despite a reject policy, say. DMARC sets the default judgment; local policy holds the gavel.
The tags that shape the instruction
rua=mailto:...- where aggregate reports go: daily XML summaries from each receiver listing every IP that sent as your domain, volumes, and pass/fail per message stream. This is the observability half of DMARC, and a policy withoutruais flying blind. (Its siblingruf=, per-message forensic reports, is largely unsupported by big receivers for privacy reasons - publish it without expectations.)pct=- apply the policy to only N percent of failing mail, e.g.p=quarantine; pct=25as a staged rollout dial. Worth knowing two things: it never applies top=none(nothing to dilute), and one major receiver quirk - Gmail treatsp=reject; pct=50as quarantine-for-everything rather than reject-for-half. Useful dial, fuzzy markings.sp=- a separate policy for subdomains.p=reject; sp=nonelocks the apex while subdomains stay observed; the inverse pattern protects an apex still under audit while parking unused subdomains at reject. Absentsp=, subdomains inheritp=.adkim=/aspf=- alignment strictness, defaulting to relaxed (r): relaxed letsmail.yourdomain.comalign withyourdomain.com; strict (s) demands exact match. Strict closes cousin-subdomain tricks at the price of breaking common legitimate patterns - most domains live correctly on relaxed.
A complete, sane record for a domain mid-hardening looks like: v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com; sp=quarantine; adkim=r; aspf=r.
Choosing a level, honestly
The decision is not which policy is "best" - reject is best, eventually, for almost everyone - but which your domain has earned the right to publish today. A domain publishes p=none the day it first thinks about DMARC, and spends weeks reading aggregate reports until every legitimate stream in them authenticates with alignment. It publishes quarantine when the reports show clean streams and the owner wants failures demoted while watching for stragglers. It publishes reject when quarantine has run quiet - no legitimate stream failing - long enough to trust the inventory.
Skipping ahead is the classic self-inflicted outage: publishing reject on day one because a security checklist demanded it, then discovering the billing system, the CRM, and the CEO's newsletter tool were all sending unaligned - as bounces, in production, all at once. The levels are not grades of virtue; they are stages of certainty about your own senders. Publish the one that matches what you actually know, and use the reports to know more.
Frequently asked questions
What DMARC policy should I use?
Start at p=none with a rua reporting address, fix every legitimate stream the reports reveal, step to p=quarantine once clean, and finish at p=reject when quarantine runs quiet. Reject is the destination; none is the correct first day.
Does p=none actually do anything?
Yes - it turns on aggregate reporting, giving you an inventory of everything sending as your domain, and it satisfies requirements like Google's bulk-sender rules that demand at least p=none. It just doesn't change delivery.
What is the difference between quarantine and reject in DMARC?
Quarantine asks receivers to treat failing mail as suspicious - typically delivering it to spam - while reject refuses it during SMTP delivery so it never arrives at all. Only reject fully stops spoofed mail.
What does pct mean in a DMARC record?
It applies the policy to a percentage of failing mail as a rollout dial, e.g. p=quarantine; pct=25. It has no effect with p=none, and Gmail notably treats a partial reject as quarantine for all failures instead.