DMARC p=none, quarantine or reject: which policy should you use?
In short: The three DMARC policies control what happens to mail that fails authentication. p=none monitors only and changes nothing. p=quarantine sends failing mail to spam. p=reject blocks it entirely. Start at none, confirm your real mail passes, then climb to reject for full protection. Build and check your record with the DMARC Generator.
On this page
p=none: monitor only
With p=none, nothing changes for recipients. Failing mail is still delivered, but you receive aggregate reports. This is the starting point for every domain. Its job is visibility: you learn which servers send as your domain and whether they authenticate, so you can fix gaps before enforcing.
p=quarantine: send to spam
With p=quarantine, mail that fails SPF and DKIM alignment is delivered to the spam or junk folder instead of the inbox. This is the middle step. It protects recipients from spoofed mail while still being forgiving enough that a missed legitimate sender lands in spam rather than disappearing.
p=reject: block entirely
With p=reject, failing mail is refused at the server and never delivered. This is full protection against domain spoofing and the policy mailbox providers trust most. Only move here once your reports confirm every legitimate sender passes, because anything not authenticated will be blocked.
Which should you use?
Everyone should end at reject, but you get there in stages. Spend a week or two at none, move to quarantine once reports are clean, then to reject. For cold email specifically, reaching quarantine or reject signals a well-managed domain. Confirm your current policy any time with the DMARC Checker.
Set the right DMARC policy
Generate a record at the policy you need and roll up to reject safely with built-in guidance.
Open the DMARC Generator →All free tools