Last updated: November 2026
Disclosure: This guide contains no paid placements. The founder of WavesRank works at an IT company that resells EasyDMARC, one of the report tools mentioned below. See our Affiliate Disclosure and Editorial Policy.
Your DMARC record has one setting that decides whether it actually protects you: the policy, written as p=. It has three possible values (none, quarantine and reject), and choosing the wrong one either leaves your domain open to spoofing or blocks your own email.
This guide explains what each DMARC policy does, how to read the reports that tell you when it is safe to move up, and a simple timeline for getting to p=reject. If you have not published a DMARC record yet, start with our DMARC setup guide.
The three DMARC policies at a glance
| Policy | What happens to email that fails DMARC | Protects your domain? | When to use it |
|---|---|---|---|
p=none |
Delivered normally; you only get reports | No | First 2–4 weeks, while you find every sender |
p=quarantine |
Usually sent to the spam or junk folder | Partly | Once nearly all real email passes |
p=reject |
Refused; never delivered | Yes | The goal for every business domain |
p=none: monitor only
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.comWith p=none, mail providers take no action on failing email. They just send you aggregate reports showing every server that sent email using your domain, and whether it passed SPF and DKIM.
- Use it to: discover all the services that send email as you, such as Microsoft 365, newsletters, invoicing software and website forms.
- The risk: criminals can still spoof your domain. Many businesses publish
p=noneand never move on, which gives a false sense of security.
p=quarantine: send failures to spam
v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.comFailing email is treated as suspicious, which in practice usually means it lands in the recipient’s junk or spam folder.
- Use it when: your reports show your legitimate email passing consistently.
- Why it’s a good middle step: if you missed a sender, its email goes to spam rather than disappearing, so it is easier to spot and fix.
p=reject: block spoofed email
v=DMARC1; p=reject; sp=reject; np=reject; rua=mailto:dmarc-reports@yourdomain.comFailing email is refused outright. This is the only setting that fully stops criminals sending email that uses your exact domain.
sp=rejectapplies the same policy to subdomains (such as billing.yourdomain.com).np=rejectcovers subdomains that do not exist, a common trick for spoofers. This tag was added in the May 2026 DMARC update (RFC 9989).
Test mode: the t tag
The 2026 DMARC update replaced the old pct tag with a simpler test mode, t=y. When you add it, receivers apply the next gentler policy:
| Your record | What receivers apply |
|---|---|
p=reject; t=y |
Quarantine |
p=quarantine; t=y |
None (monitor only) |
It is a safe way to announce a stricter policy while you watch the reports. Some older mail systems may ignore t, so do not rely on it for long; remove it once you are confident.
How to read DMARC aggregate reports
Aggregate (rua) reports are XML files sent by Google, Microsoft, Yahoo and other providers, usually once a day. Each report lists, for a given period:
| Field | What it tells you |
|---|---|
| Source IP | The server that sent the email |
| Count | How many messages came from that server |
| SPF result and domain | Whether SPF passed, and for which domain |
| DKIM result and domain | Whether DKIM passed, and for which domain |
| DMARC result | Whether at least one check passed and aligned with your From domain |
| Disposition | What the receiver did: none, quarantine or reject |
Reading raw XML is tedious, so most businesses use a DMARC report tool that groups results by sender. Free options include Cloudflare DMARC Management (if your DNS is on Cloudflare) and Postmark’s weekly DMARC digests; paid platforms such as EasyDMARC, dmarcian and Valimail add alerts and guided fixes.
What to look for
- Your own services passing. Microsoft 365, Google Workspace and each third-party tool should show DMARC pass.
- Your own services failing. A known tool failing DMARC usually needs DKIM set up with your domain, or adding to SPF. Fix these before moving up.
- Unknown sources. Servers you don’t recognise sending as your domain are usually spoofing attempts, exactly what
p=rejectwill stop. - Forwarding noise. Some failures come from legitimate forwarding (for example a mailing list). These are normal in small numbers; DKIM usually survives forwarding better than SPF.
A safe timeline from none to reject
| Week | Policy | What you do |
|---|---|---|
| 1–3 | p=none |
Collect reports, list every sender, fix SPF and DKIM |
| 4–5 | p=quarantine; t=y |
Announce quarantine in test mode, keep watching |
| 5–6 | p=quarantine |
Failures now go to spam; fix anything missed |
| 7–8 | p=reject |
Full protection; keep reviewing reports monthly |
Small businesses with only Microsoft 365 or Google Workspace and one or two other tools can often move faster. Larger or older domains with many senders may need longer.
Which policy should you use?
- Just published DMARC?
p=nonefor a few weeks. - Reports clean for 2+ weeks? Move to
p=quarantine. - Quarantine stable with no complaints? Move to
p=reject. - Domain you don’t send email from? Go straight to
p=rejectwithv=spf1 -all. There is nothing to break.
Frequently asked questions
Is p=none bad? It is fine as a starting point, but it does not stop spoofing. It should be temporary.
Will p=reject block my own emails? Only if a service sending as your domain is not set up with SPF or DKIM. That is why you monitor first and fix every legitimate sender before moving to reject.
Do Google, Yahoo and Microsoft require p=reject? Their bulk-sender rules require a DMARC record (p=none is accepted as a minimum), but a stronger policy gives better protection against spoofing.
How often should I check DMARC reports after reaching p=reject? Monthly is enough for most small businesses, plus whenever you add a new email tool.
What happened to the pct tag? The May 2026 DMARC update replaced pct with the t test-mode tag. Existing records with pct keep working, but new records should use t=y instead.