What are the three DMARC policy modes you should know?

DMARC has three policy modes: none, quarantine, and reject. Each one tells receiving mail servers what to do when an email fails DMARC authentication checks. The policy you choose determines how aggressively your domain is protected against spoofing and phishing. This article walks through what each mode does, how they differ, and how to move through them safely toward full enforcement.

What does each DMARC policy mode actually do?

Each DMARC policy mode instructs receiving mail servers how to handle messages that fail authentication. The none mode takes no action and only collects data. The quarantine mode sends failing messages to the spam folder. The reject mode blocks failing messages entirely, preventing them from reaching the recipient at all.

Here is what each mode looks like in a DMARC record and what it signals to receiving servers:

• p=none: Monitor-only mode. Emails that fail DMARC checks are delivered as normal. No action is taken, but aggregate and forensic reports are generated so you can see what is sending on behalf of your domain.
• p=quarantine: Emails that fail DMARC checks are routed to the recipient’s spam or junk folder rather than the inbox. The message is still delivered, just with reduced visibility.
• p=reject: Emails that fail DMARC checks are rejected outright by the receiving server. The message never reaches the recipient, and the sender typically receives a bounce notification.

The three modes form a progression. Most domain owners start at none to gather intelligence, move to quarantine to test enforcement, and then advance to reject once they are confident all legitimate sending sources are properly authenticated.

What’s the difference between DMARC quarantine and reject?

The key difference between DMARC quarantine and reject is what happens to the failing message. With quarantine, the email is delivered but treated as suspicious and placed in the spam folder. With reject, the email is not delivered at all. Reject is the stricter enforcement level and provides stronger protection against domain spoofing.

Choosing between quarantine and reject often comes down to confidence in your email infrastructure. Quarantine is a useful middle ground because it limits the damage from unauthorized senders without risking the loss of legitimate mail. If a legitimate sending source is misconfigured and fails DMARC, quarantine means those messages are still retrievable from spam rather than permanently lost.

Reject, on the other hand, is the gold standard for domain protection. Major mailbox providers and security frameworks increasingly expect domains to operate at p=reject, particularly for domains used in transactional or business-critical email. Once you reach reject, unauthorized senders impersonating your domain are stopped before they can do any harm to your recipients or your brand reputation.

The practical implication is this: move to reject only when you are certain every legitimate mail stream from your domain is passing SPF and DKIM alignment. Any legitimate source that is not properly authenticated will be blocked alongside the fraudulent ones.

When should you use DMARC policy p=none?

You should use DMARC policy p=none when you are first implementing DMARC and need to audit your sending environment before enforcing any policy. The none mode lets you collect DMARC aggregate reports without affecting mail delivery, giving you visibility into every source sending email on behalf of your domain.

The none policy is strictly a monitoring tool, not a protection tool. It does nothing to stop spoofed or unauthorized email from reaching recipients. Its value is entirely in the data it generates. When you publish p=none alongside a valid reporting address (the rua tag), receiving mail servers will send you reports showing which IP addresses sent mail claiming to be from your domain and whether those messages passed or failed SPF and DKIM checks.

Where organizations go wrong is treating p=none as a permanent setting. Staying at none indefinitely means your domain remains unprotected against impersonation. The none phase should be a diagnostic window, typically lasting a few weeks to a couple of months, not a long-term configuration choice. The goal is to use the report data to identify and authenticate all legitimate senders so you can move forward with confidence.

How do you move from DMARC none to full enforcement?

Moving from DMARC none to full enforcement follows a staged process: collect and analyze DMARC reports at p=none, resolve authentication gaps for all legitimate sending sources, advance to p=quarantine at a low percentage, gradually increase that percentage, and finally move to p=reject once your pass rate is consistently high.

Here is the step-by-step path:

1. Publish p=none with a reporting address. Set up your DMARC record with a valid rua address to start receiving aggregate reports. Give this phase enough time to capture a representative sample of your mail streams.
2. Audit your sending sources. Review the reports to identify every service, platform, or IP address sending mail from your domain. This often surfaces forgotten tools, third-party platforms, and shadow IT senders.
3. Authenticate all legitimate senders. Ensure every identified sending source has properly configured SPF records and DKIM signing. Check that both align with your domain as required by DMARC.
4. Move to p=quarantine with a low percentage. Use the pct tag to apply the quarantine policy to a small portion of failing mail first, such as pct=10. This limits the impact while you validate your setup.
5. Increase the percentage gradually. As your DMARC pass rate improves and you resolve remaining authentication issues, raise the pct value in stages toward 100.
6. Advance to p=reject. Once you are consistently seeing high pass rates and have resolved all known sending gaps, update your policy to p=reject at 100 percent.

The timeline varies depending on the complexity of your sending environment. Organizations with many third-party senders or legacy systems typically need more time in the monitoring and quarantine phases than those with simpler setups.

Why does DMARC policy enforcement fail even when it’s set correctly?

DMARC policy enforcement can fail even with a correctly published record because DMARC requires both SPF and DKIM to align with the domain in the From header, not just pass independently. If a legitimate sending source passes SPF or DKIM but the authenticated domain does not match the From domain, DMARC will still fail for those messages.

Several specific scenarios cause enforcement to break down in practice:

• Forwarded email: When email is forwarded, the original SPF alignment breaks because the forwarding server’s IP is not listed in the sending domain’s SPF record. If DKIM is not in place or the signature is stripped during forwarding, DMARC will fail on forwarded messages.
• Third-party senders not configured for alignment: Many marketing platforms, CRMs, and transactional email services send from their own infrastructure. If they are not set up to sign with your domain’s DKIM key or use a subdomain that aligns with your From address, those messages will fail DMARC even if they pass the platform’s own authentication checks.
• SPF record too long or broken: SPF has a lookup limit of ten DNS lookups. Exceeding this limit causes SPF to return a permanent error, which means DMARC cannot use SPF alignment for those messages.
• Subdomain policy gaps: If your organizational domain is at p=reject but you have not set a subdomain policy (the sp tag), subdomains may default to a more permissive setting depending on the receiving server’s interpretation.
• Mismatched From domain: Some sending tools use a different domain in the technical headers than in the visible From address. DMARC evaluates the domain in the RFC5322 From header, so mismatches between header domains will cause failures that look confusing when reviewing records.

Diagnosing these failures requires reading DMARC aggregate reports carefully and, in some cases, forensic reports that show individual failing messages. The root cause is almost always an alignment issue rather than a problem with the DMARC record itself.

How Email Industries helps with DMARC policy implementation

Getting DMARC policy right is one of the most impactful steps you can take for email authentication and deliverability, but the path from p=none to p=reject is rarely straightforward. We work with organizations at every stage of that journey, helping them avoid the common pitfalls that stall enforcement or cause legitimate mail to get blocked.

Here is what we bring to the process:

• DMARC report analysis: We interpret your aggregate and forensic reports to identify every sending source, flag authentication gaps, and prioritize what needs to be fixed before you advance your policy.
• Authentication remediation: We help configure SPF alignment, set up DKIM signing for third-party senders, and resolve issues like SPF lookup limits that silently break enforcement.
• Policy progression planning: We build a staged rollout plan from quarantine to reject that minimizes the risk of blocking legitimate mail while moving you toward full protection.
• Ongoing monitoring: Through our Deliverability Assurance Packages, we keep a continuous eye on your DMARC pass rates and alert you to new sending sources or authentication failures before they become problems.

If your domain is stuck at p=none, struggling with unexplained enforcement failures, or you simply want expert guidance to get to p=reject without disrupting your mail flow, our services are built for exactly that. Reach out and contact us to talk through where your DMARC setup stands and what it would take to get to full enforcement.

Related Articles

• What is BIMI and how does it work in email?
• How does SPF protect your email sender reputation?
• What pricing models do full service email agencies use?
• Should you hire an expert for an email platform migration?
• What are the biggest mistakes made during domain warmup?
• How do you monitor deliverability during an IP warming campaign?
• How do inbox providers evaluate a new IP address?
• What is an IP warming strategy in email marketing?
• What is a good sender reputation score before ending IP warming?
• What software platforms do deliverability agencies recommend?
• What is email infrastructure consulting used for?
• Can you prevent future blacklisting after removal?
• What is the process for deliverability audits?
• How long does blacklist removal typically take?
• What should you look for in email deliverability agencies?