DMARC Policy Explained: none vs quarantine vs reject

If you have set up DMARC, you have chosen a policy - none, quarantine or reject. That one setting decides what happens to email that fails authentication for your domain. Getting it right is the difference between actually stopping spoofing and just watching it happen. Here is what each means and how to progress safely.

Quick recap: what DMARC does

DMARC builds on SPF and DKIM. It tells receiving servers what to do when a message claiming to be from your domain fails those checks - and sends you reports on what is happening. (New to this? Start with SPF, DKIM and DMARC explained.)

The action is set by the policy tag, p=.

p=none (monitor only)

p=none means: do nothing different - deliver the mail as normal, but send me reports. It is purely observational.

• Use it: at the very start, to see who sends mail as your domain (including legitimate services you forgot about) without risking anything.
• The trap: many businesses set p=none and stop there. It provides zero protection against spoofing - it only watches. See DMARC reports explained for reading the data.

p=quarantine (send to spam)

p=quarantine means: if a message fails, treat it as suspicious - typically deliver it to the spam/junk folder.

• Use it: once your reports confirm your legitimate mail is passing. It starts actually protecting you while being slightly forgiving (failed mail is filed, not destroyed).

p=reject (block outright)

p=reject means: if a message fails, refuse it entirely - it never reaches the recipient.

• Use it: as the end goal. This is what truly stops spoofing - nobody can deliver mail pretending to be your domain. See what is email spoofing and how to prevent it.

The safe progression

Never jump straight to reject - you could block your own legitimate mail (newsletters, invoicing tools, helpdesks you forgot authenticate as you). The proven path:

1. Start at p=none and read reports for a few weeks
2. Make sure every legitimate sender passes SPF and/or DKIM
3. Move to p=quarantine and keep watching
4. Once clean, move to p=reject for full protection

Each step, keep an eye on the reports before advancing.

Don't stop at none

The single most common DMARC mistake is leaving the policy at none forever - it feels "done" but protects nothing. The goal is to reach enforcement (quarantine, then reject).

We get you to enforcement safely

Reading DMARC reports and advancing the policy without breaking mail takes care. DigiCloudMail helps you configure authentication and move DMARC to enforcement safely - so spoofers are blocked and your real mail still flows.

Want your domain protected at DMARC enforcement? Get in touch.