Resources  / DMARC and mail

DMARC policy: none, quarantine and reject

A DMARC record is one line of text in DNS, at _dmarc. in front of your domain. The p= tag in it is the policy: what a receiving mail server does with mail that claims to be from your domain and cannot prove it. Mail proves it when SPF or DKIM passes for the domain in the From address.

v=DMARC1; p=none; rua=mailto:dmarc@example.com

Even the weakest record matters now. Since 5 November 2026, mail providers report Outlook.com and Hotmail refusing part of the mail from domains that publish no DMARC record at all, even when SPF and DKIM pass. Check whether yours is affected.

The three policies

p=none watches and does nothing

A record at none protects nobody: a forgery of your domain is delivered as before. It is still worth having. It is a valid record, which is what the Outlook.com bounces lacked, and with rua= it brings reports. The reports are the point. Each receiver sends one a day, listing every server that sent mail as your domain and whether that mail passed. That list is how you find the services that send as you before a stricter policy starts to stop their mail.

v=DMARC1; p=none; with no rua= asks for nothing at all. It is the right first record when you need one today. It is not a place to stay.

quarantine and reject act on failing mail

At quarantine, receivers put failing mail in spam. At reject, they refuse it, and the sender gets a bounce. Both act on your own mail too: a billing tool or a newsletter service that does not sign as your domain fails the same way a forgery does. That is why the order matters.

pct= lets you apply the policy to part of the failing mail while you watch the reports: p=quarantine; pct=25 sends a quarter of it to spam and treats the rest as none. The newer version of the standard drops pct= for a t=y testing flag. Receivers still read pct=.

The other tags

v=DMARC1

The version. It must be the first tag, written exactly so.

p=

The policy for the domain: none, quarantine or reject. Required.

sp=

The policy for names under the domain, such as mail.example.com. Without it they follow p=.

np=

The policy for names under the domain that do not exist. A newer tag; receivers that do not know it use sp=.

rua=

Where to send the daily aggregate reports. One or more mailto: addresses, separated by commas.

ruf=

Where to send failure reports about single messages. Few large receivers send them.

adkim=, aspf=

How closely the DKIM and SPF domains must match the From domain: r, relaxed (the default), or s, strict.

pct=

The part of failing mail the policy applies to, from 0 to 100. The rest gets the next policy down.

A name with no record of its own takes the record of its organizational domain. So mail.example.com gets the sp= policy of example.com, or its p= when there is no sp=.

From none to reject without losing mail

1. Publish p=none with a rua= address that somebody, or something, reads.
2. Read two to four weeks of reports. Name every server that sends as your domain: your mailbox provider, and each application that sends for you.
3. Make each one pass: sign with DKIM as your domain, or send from a return path under it.
4. Move to p=quarantine, at a low pct= first if you send a lot. Watch the reports for your own mail failing.
5. Move to p=reject. Keep reading the reports: a new tool someone signs up for next year fails the same way.

Mistakes that break the record

A receiver that cannot read the record treats the domain as having none.

Check yours

The Deliverability check reads your record, says what is wrong with it in one line, and gives a fixed record to paste. Sender Security reads your reports for you, so you can see who sends as your domain before you move to reject.