DMARC Policy Explained
None, quarantine and reject
p=none requests reporting but no DMARC-based enforcement. p=quarantine asks receivers to treat failing aligned mail suspiciously, commonly by placing it in spam. p=reject asks receivers not to accept failing aligned mail. Receivers ultimately apply their own local policies.
Alignment is the important detail
DMARC passes when at least one of SPF or DKIM both passes and aligns with the visible From domain. An email can therefore show an SPF pass for a provider-controlled bounce domain yet still fail DMARC alignment.
Use reports as evidence
Aggregate reports show sending sources and authentication outcomes, not message bodies. Use them to find legitimate platforms and abuse before enforcing. RFC 9989 removed the former percentage tag because receiver application was inconsistent; it must not be treated as an enforcement safety boundary.
Authoritative references
Read the underlying standards and provider instructions before changing production DNS: RFC 7208 (SPF), RFC 9989 (DMARC), Google Workspace SPF guidance and your sending provider's current DKIM documentation.
Enforcement decision record
Record the current policy, subdomain policy, report destinations, known aligned senders, unresolved failures, proposed next setting, owner and rollback value. Do not strengthen policy because a generic score says the domain is ready.
Worked rollout
A domain can begin with p=none to collect evidence and consider quarantine only after legitimate sources align and current receiver and provider guidance is reviewed. General-purpose email domains need particular caution before reject. The exact timetable depends on sending patterns and risk.
Third-party report addresses
If aggregate reports go to another domain, check whether the receiving service requires an external-report authorisation record and confirm its current setup instructions.
Editorial responsibility
Published by Acerville Sparks Limited. Software assists research, drafting and automated record testing. Internet standards, provider documentation, reproducible checks and limitations are shown so readers can inspect the work. No independent deliverability consultant review is claimed. Reviewed 4 September 2026.
What this site does not do
No inbox guarantee. No live DNS checks. No storage of entered data. No passwords or private keys requested.