Definition
DMARC policy modes are the three enforcement settings a domain owner can publish to tell receiving servers how to handle messages that fail DMARC authentication. The modes are defined by the p= tag in the DMARC record and take one of three values: none, quarantine, and reject. Each mode represents a progressively stricter response to unauthenticated mail.
How It Works
The published policy applies only to messages that fail DMARC alignment. Messages that pass SPF or DKIM with alignment are unaffected by the policy choice.
| Mode | Value | Behaviour for failing mail |
|---|---|---|
| Monitor | p=none |
Deliver normally; collect data only |
| Quarantine | p=quarantine |
Deliver to spam or a restricted folder |
| Reject | p=reject |
Refuse delivery entirely |
The standard adoption path moves through the modes in order. A domain starts at p=none to observe which sources are sending and failing, fixes every legitimate source, then moves to p=quarantine to begin enforcement, and finally to p=reject for full protection. The pct= tag can be used to phase enforcement in gradually rather than switching all at once.
Why It Matters
The choice of mode balances protection against disruption. A p=none policy provides visibility without protection, while p=reject provides maximum protection against email spoofing but risks rejecting legitimate mail that has not been properly authenticated.
Key considerations for each mode:
p=noneis appropriate only as a temporary monitoring state; leaving it indefinitely leaves the domain open to spoofing.p=quarantineis a useful intermediate state that limits damage while still allowing recovery of misrouted mail.p=rejectis the goal for security-conscious domains and is required for BIMI logo display.
The right mode depends on how confident the domain owner is that every legitimate sending source authenticates correctly. Monitoring aggregate reports during each transition is how that confidence is built.
Example
A financial services firm moves from p=none to p=quarantine after six weeks of clean reports, then to p=reject once a final legacy sender is fixed. Spoofed messages using the firm's domain are now rejected at the receiving server rather than reaching recipients.
Was this useful?
Related Glossary Terms
Abuse Complaint
An abuse complaint is a report from a recipient who marks an email as spam, which negatively affects sender reputation and deliverability.
Alt Text
Alt text is the written alternative to an image in an email, displayed when images are blocked, slow to load, or consumed by screen readers.
AOL Mail for Email Marketers
AOL Mail is a legacy email provider with specific deliverability requirements and rendering quirks, now operating as part of the Yahoo+AOL network under shared infrastructure.
Email Authentication Protocols
Email authentication protocols are technical standards that verify the identity of an email sender, helping mailbox providers distinguish legitimate mail from spam and phishing.
BIMI
BIMI (Brand Indicators for Message Identification) is an email standard that allows brands to display their logo next to their emails in supported email clients. It requires DMARC enforcement at quarantine or reject policy.
Bounce Management
Bounce management is the process of handling emails that are rejected by mailbox providers, including classification, removal of bad addresses and protection of sender reputation.
Frequently Asked Questions
Start with `p=none` to monitor and identify all legitimate sending sources, then move to `p=quarantine` and finally `p=reject` as you confirm everything authenticates correctly.
No. `p=none` asks receivers to take no action, so it provides monitoring only. It should be a temporary state on the path to enforcement, not a permanent configuration.
Quarantine routes failing mail to spam or a restricted folder, while reject refuses delivery at the SMTP level so the message never arrives. Reject is stronger but riskier if legitimate mail is not yet authenticated.
Yes, using the `pct=` tag to apply the policy to a percentage of failing messages. This allows gradual rollout of quarantine or reject without affecting all mail at once.