DMARC p=none vs quarantine vs reject: a safe rollout plan

The goal is p=reject. The way there is four steps, each taken only when your reports say every real sender is aligned.

By peekip editorialLast checked 5 Oct 20262 min read4 sources

On this page

Short answer

p=none asks receivers to do nothing special and just report; p=quarantine asks them to treat failing mail as suspicious (usually the spam folder); p=reject asks them to refuse it. Start at none with a rua address, fix every legitimate sender until reports show it aligned, then move to quarantine (optionally in RFC 9989 test mode, t=y), then reject. Parked domains can go straight to reject.

What each policy asks for

Policy	What it asks receivers	What usually happens
`p=none`	No specific action for mail that fails DMARC	Delivery unchanged; you receive reports
`p=quarantine`	Accept failing mail but treat it as suspicious	Microsoft: junk folder, quarantine, or a marked message, depending on the receiver^[2]
`p=reject`	Refuse failing mail	Microsoft: “typically discarded”^[2]

The policy is a request. Each receiver decides what to do, and some apply their own filtering on top.

The four steps

Step 1p=noneCollect reports. Find every service that sends as you.

Step 2p=quarantine; t=yRFC 9989 test mode: receivers apply one level lower (none).

Step 3p=quarantineFailing mail goes to spam at receivers that honour it.

Step 4p=rejectFailing mail is refused.

RFC 9989, the current DMARC standard (May 2026), defines the test flag: if the policy is quarantine and t=y, “a policy of ‘none’ will be applied to failing messages”; if the policy is reject and t=y, quarantine is applied instead.^[1] It replaces the old pct percentage tag, which the new standard removed.^[1] Google and Microsoft guides still describe pct;^[2]^[3] receivers vary in which version they follow, so a test-mode record may be applied as written by some. Plan each step as if it were real.

Step 1: monitor (p=none)

v=DMARC1; p=none; rua=mailto:[email protected]

Google suggests starting here and tightening as you learn how your mail authenticates.^[3] If the rua address is at another domain (a reporting service), that domain must publish a TXT record at yourdomain._report._dmarc.theirdomain containing v=DMARC1, or receivers won’t send reports there.^[4]

Move on when at least two weeks of reports show every service you recognise passing DMARC by SPF or DKIM alignment, and what remains fails because it isn’t you.

Step 2 and 3: quarantine

v=DMARC1; p=quarantine; t=y; rua=mailto:[email protected]

Then remove t=y. Move on when a few weeks at quarantine show no complaints from colleagues about missing mail and reports show no new legitimate sources failing.

Step 4: reject

v=DMARC1; p=reject; rua=mailto:[email protected]

Keep reading reports. New tools added later are the usual cause of surprise failures.

Run it on yours

See where you are on the path

The domain report reads your DMARC record and shows your current step and what to fix before the next.

Subdomains and domains you don’t use

Your record covers subdomains that don’t publish their own, including ones that don’t exist; sp= sets a different policy for existing subdomains and np= for non-existent ones.^[1] Microsoft suggests rolling out on low-volume subdomains first and saving the parent domain for last.^[2]

For a domain that never sends mail, skip the path: publish v=DMARC1; p=reject;.^[2]

Sources

RFC 9989: Domain-based Message Authentication, Reporting, and Conformance (DMARC) (May 2026) · IETF / RFC EditorChecked 5 Oct 2026
Set up DMARC to validate email in Microsoft 365 · Microsoft LearnChecked 5 Oct 2026
Set up DMARC · Google Workspace Admin HelpChecked 5 Oct 2026
RFC 9990: DMARC Aggregate Reporting (May 2026) · IETF / RFC EditorChecked 5 Oct 2026