p=none, quarantine, reject: which DMARC policy should you choose?

The p= tag in your DMARC record tells recipients what to do with a message that fails authentication. Three possible values, and only one sensible way to move between them.

p=none — observe

Nothing changes for the messages: they are delivered as before, whether or not they pass. What changes is that you receive the reports. It is a measurement mode, not a protection.

It is always the starting point, and its value is real: it is the only way to discover the full inventory of what sends in your name. Almost always longer than expected — marketing tools, billing, CRM, website forms, forgotten contractors.

The trap: staying on none indefinitely. That policy protects nothing; a domain on p=none remains trivially spoofable.

p=quarantine — set aside

Non-compliant messages are delivered but treated as suspicious — in practice, the junk folder. The recipient can still find them.

This is the intermediate step: a misconfiguration lands a message in spam rather than losing it. The pct= tag lets you get there gradually — pct=25 applies the policy to only a quarter of non-compliant messages.

p=reject — refuse

The message is refused at delivery time, at every provider that enforces the policy. It arrives nowhere, not even in junk.

It is the only level that genuinely protects your domain against spoofing — and the only one where a misconfiguration makes legitimate mail vanish without anyone noticing for days.

The progression that works

1. SPF and DKIM first, on every legitimate sender. The guides by provider give the exact values.
2. p=none with rua=, for two to four weeks. The goal is a complete inventory, not an impression.
3. Fix every legitimate sender that is not aligned. This is where the real work happens.
4. p=quarantine, optionally with an increasing pct=. Watch the reports closely.
5. p=reject once the compliance rate of your legitimate mail is stable and close to 100%.

Two details that cost dearly

• Subdomains inherit the parent domain’s policy unless you publish sp=. A forgotten subdomain that still sends mail falls with the rest.
• A domain that sends nothing still deserves p=reject: it is in fact the simplest and most urgent case, since nothing can break.

Every step of that progression is steered by the reports: Clarsend tracks the compliance rate per domain and alerts you when it degrades — the signal that should stop you from tightening, or warn you that a setup changed after the fact.