DMARC policies explained: none, quarantine and reject

DMARC tells receiving mail servers what to do with email that claims to come from a domain but fails authentication. It is the record that stops attackers spoofing a client’s exact domain.

The three policies

Policy	What receivers do with failing mail	When to use it
p=none	Deliver it as normal; only report	Starting out, while you find every sender
p=quarantine	Treat it as suspicious, usually the junk folder	Once legitimate senders pass
p=reject	Refuse it	The goal for most business domains

p=none is useful for a short while, but it protects nothing. A domain left on p=none for years is a common finding on MSP client lists.

Alignment: the part people miss

DMARC passes when SPF or DKIM passes and is aligned with the domain in the visible From: address.

• SPF alignment — the envelope sender (the bounce address) must match the From: domain.
• DKIM alignment — the d= domain in the DKIM signature must match the From: domain.

Relaxed alignment (the default) accepts subdomains; strict alignment (aspf=s, adkim=s) does not. Many third-party senders pass SPF on their domain, not yours — so they fail DMARC unless you set up DKIM signing for your domain in that service.

A record, piece by piece

v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com; adkim=r; aspf=r

• v=DMARC1 — required, always first.
• p= — the policy for the domain.
• sp= — optional policy for subdomains (defaults to p).
• rua= — where aggregate reports are sent.
• adkim= / aspf= — r relaxed or s strict alignment.

The record lives at _dmarc.example.com as a TXT record.

A safe path to reject

1. Publish p=none with a rua= address and collect reports for two to four weeks.
2. Find every legitimate sender in the reports. Set up DKIM for each one.
3. Move to p=quarantine once legitimate mail passes.
4. Move to p=reject after another quiet period.
5. Keep watching: a new marketing tool or a migration can break alignment at any time.

Watchvera reads the DMARC record on every client domain, flags a missing record as critical and p=none as a warning, and gives you the record to publish.

See how Watchvera handles this: DMARC, SPF and DKIM monitoring.