DMARC p=reject vs p=quarantine vs p=none

The p= tag in your DMARC record determines what happens when an email fails authentication. It is the most important decision in your DMARC configuration.

p=none — monitoring only

With p=none, DMARC has no enforcement. Emails that fail authentication are delivered normally. However, DMARC reports are still sent to your rua= address, giving you visibility into who is sending email using your domain.

Use when: You are just starting with DMARC and want to understand your email traffic before enabling enforcement. Never leave p=none permanently — it provides no spoofing protection.

p=quarantine — send to spam

With p=quarantine, emails that fail DMARC are placed in the recipient's spam or junk folder. They are not rejected outright, giving you a safety net if a legitimate sender is misconfigured.

Use when: You have reviewed your DMARC reports and are confident your main sending services pass authentication, but want a buffer in case something was missed.

p=reject — block entirely

With p=reject, emails that fail DMARC are rejected at the server level — the recipient never sees them. This is the strongest protection and the goal every domain should work toward.

Use when: You are certain all your legitimate senders pass DMARC and are ready for full enforcement. Once at reject, spoofed emails using your domain are blocked by every major mail provider.

Recommended migration path

1. Start at p=none; pct=100 — collect reports for 2–4 weeks
2. Review reports, identify all legitimate senders, fix misconfigurations
3. Move to p=quarantine; pct=10 — apply to 10% of traffic first
4. Gradually increase: pct=50, then pct=100
5. Once stable, move to p=reject; pct=100

The pct= tag

The pct= tag (default: 100) controls what percentage of failing emails the policy applies to. Setting pct=10 with p=quarantine means only 10% of failing emails go to spam — a useful rollout strategy.