p=none vs p=quarantine vs p=rejectThe policy tag tells receivers what to do with mail that fails DMARC — that is, mail where neither SPF nor DKIM passes and aligns with your From: domain.
| Policy | What the receiver does | Use it when |
|---|---|---|
p=none | Nothing. Delivers as normal, but sends you reports. | You are still discovering who sends as you. |
p=quarantine | Spam folder. | Reports are clean but you want a safety net. |
p=reject | Refused at SMTP. The message is gone. | Every legitimate sender is authenticated. |
p=none protects nobodyThis is the trap. Publishing p=none makes a checker turn green and stops exactly
zero spoofing. It is a monitoring mode, not a policy. Huge numbers of domains have sat at
p=none for years believing they are protected. They are not.
It is still the correct first step — just not the last one.
p=none with reports. Publish
v=DMARC1; p=none; rua=mailto:[email protected]. Aggregate reports arrive daily as
XML; feed them to any DMARC report parser.p=quarantine; pct=25. The pct tag
applies the policy to a fraction of failing mail. Ramp 25 → 50 → 100 while watching
reports.p=reject. Only when failures are all genuine spoofing.DMARC does not just ask “did SPF pass?” It asks whether the passing domain matches the domain in the From: header. Mail sent through a vendor can pass SPF for the vendor's domain and still fail DMARC. Fix it by setting up a custom return-path / DKIM signing domain with that vendor.
Google and Yahoo require a DMARC record from anyone sending bulk mail to their users, plus
SPF, DKIM and one-click unsubscribe. p=none satisfies the letter of it; it does not
satisfy the intent.
MailGate — free SPF, DKIM & DMARC checker. Check any domain →