DMARC Policy Types (DMARC Policy)

Security Glossary - Email Authentication

Definition: DMARC policies (p=none, p=quarantine, p=reject) instruct receiving mail servers on how to handle emails that fail DMARC authentication. 'none' takes no action (monitoring only), 'quarantine' sends failing emails to spam, and 'reject' prevents delivery entirely. The pct tag allows gradual rollout by applying the policy to a percentage of messages.

The Importance of DMARC Policy

Choosing the right DMARC policy is a balance between security and operational risk. A p=reject policy provides the strongest protection against email spoofing but will also block any legitimate email that is not properly authenticated. Deploying reject without thorough preparation can cause critical business emails to disappear.

The recommended rollout path is: p=none (collect data for 2-4 weeks), analyze reports to fix authentication gaps, p=quarantine with pct=25 (test with a fraction), gradually increase pct to 100, then finally p=reject. This staged approach catches configuration problems before they affect all email.

The sp tag in DMARC controls the policy for subdomains. Even if your main domain has p=reject, subdomains default to the parent policy unless sp is set differently. If you do not send email from subdomains, set sp=reject to prevent attackers from spoofing them.

Key Parameters

PolicyDMARC TagEffect on Failing Email
nonep=noneNo action, monitoring only
quarantinep=quarantineDelivered to spam/junk folder
rejectp=rejectRejected by receiving server

How to Test for DMARC Policy

A DNS health checker shows your DMARC policy and evaluates whether it is enforcing (quarantine or reject) or monitoring only (none). If you are still on p=none after collecting data for weeks, it may be time to move toward enforcement.

DMARC Policy FAQ

How long should I stay on p=none?
Typically 2-4 weeks, long enough to collect aggregate reports covering all your email sources. If reports show all legitimate email passing DMARC, you can move to quarantine. If you discover unauthenticated legitimate sources, fix them before advancing.
What does the pct tag do?
The pct tag applies the DMARC policy to only a percentage of failing messages. pct=25 means 25% of failing emails get the policy treatment (quarantine or reject) while 75% pass through. This allows gradual rollout to catch issues before they affect all email.
Disclaimer: DomainOptic provides automated informational scans only. Results do not constitute professional security advice, compliance certification, or a guarantee of security. Always verify findings independently.