DMARC p=reject vs p=quarantine vs p=none

The p= tag in your DMARC record determines what happens when an email fails authentication. It is the most important decision in your DMARC configuration.

p=none — monitoring only

With p=none, DMARC has no enforcement. Emails that fail authentication are delivered normally. However, DMARC reports are still sent to your rua= address, giving you visibility into who is sending email using your domain.

Use when: You are just starting with DMARC and want to understand your email traffic before enabling enforcement. Never leave p=none permanently — it provides no spoofing protection.

p=quarantine — send to spam

With p=quarantine, emails that fail DMARC are placed in the recipient's spam or junk folder. They are not rejected outright, giving you a safety net if a legitimate sender is misconfigured.

Use when: You have reviewed your DMARC reports and are confident your main sending services pass authentication, but want a buffer in case something was missed.

p=reject — block entirely

With p=reject, emails that fail DMARC are rejected at the server level — the recipient never sees them. This is the strongest protection and the goal every domain should work toward.

Use when: You are certain all your legitimate senders pass DMARC and are ready for full enforcement. Once at reject, spoofed emails using your domain are blocked by every major mail provider.

Recommended migration path

1. Start at p=none — collect reports for 2–4 weeks
2. Review reports, identify all legitimate senders, fix misconfigurations
3. Move to p=quarantine; t=y — receivers still deliver failing mail normally while you watch the reports
4. Remove t=y: failing mail now goes to spam
5. Move to p=reject; t=y (failing mail goes to spam), then remove t=y for full enforcement

The t= tag (testing)

With t=y, receivers apply one level less than your policy: reject is treated as quarantine, quarantine as none. It lets you publish the policy you are aiming for and watch its effect in the reports before it bites. It has no effect on p=none.

It replaces the old pct= tag. A percentage of failing mail is no longer part of DMARC: receivers that follow the current standard ignore pct= and apply the policy to all failing mail.

According to RFC 9989 (May 2026).