Email Authentication

What is a DMARC record, and what do p=none, quarantine and reject mean?

Inboxlogy7 min readUpdated 2026-10-26

In short: A DMARC record tells mailbox providers what to do when an email claiming to be from your domain fails SPF and DKIM, and where to send reports. Its policy is set by the p= tag: none (monitor only), quarantine (send to spam), or reject (block). Since 2024, Google and Yahoo require a DMARC record for bulk senders, so having one is no longer optional.

On this page

  1. What does a DMARC record do?
  2. What do the DMARC policies mean?
  3. What is DMARC alignment?
  4. Why DMARC matters for cold email

What does a DMARC record do?

DMARC stands for Domain-based Message Authentication, Reporting and Conformance. It sits on top of SPF and DKIM and does two things: it tells receivers how to handle mail that fails authentication, and it asks them to send reports on who is sending mail as your domain. The record lives in DNS at _dmarc.yourdomain.com and starts with v=DMARC1.

Key point: DMARC only acts when SPF or DKIM fails and does not align with your domain. If your legitimate mail passes and aligns, DMARC never touches it. That is why getting SPF and DKIM right first is essential before you tighten DMARC.

What do the DMARC policies mean?

The p= tag sets enforcement:

  • p=none monitors only. Failing mail is still delivered, but you receive reports. This is where you start.
  • p=quarantine sends failing mail to the spam folder.
  • p=reject blocks failing mail outright. This is the strongest protection against spoofing.

The usual path is none, then quarantine, then reject, moving up only once your reports confirm all legitimate mail passes.

What is DMARC alignment?

Alignment is the part people miss. For DMARC to pass, SPF or DKIM must not only pass but also align with the domain in the visible From address. SPF alignment checks the return-path domain, and DKIM alignment checks the signing domain. Mail can pass SPF yet still fail DMARC if the domains do not match. This is common when you send through a third-party tool that uses its own domain in the return path.

Why DMARC matters for cold email

Since February 2024, Google and Yahoo require a DMARC record for anyone sending in volume. Beyond compliance, DMARC is a strong trust signal: it shows mailbox providers you care about who sends mail as your domain. For cold outreach, a domain with DMARC at quarantine or reject looks established and deliberate, while a domain with no DMARC looks unmanaged. Use a DMARC Checker to confirm your policy is published and read it in plain English.

Check your DMARC policy free

See whether DMARC is published, read your policy (none, quarantine or reject) in plain English, and spot missing reporting tags.

Open the DMARC Checker →All free tools

Frequently asked questions

Where does the DMARC record go?
In DNS as a TXT record at the hostname _dmarc.yourdomain.com. It starts with v=DMARC1 and includes your policy (p=) and usually a reporting address (rua=).
Should I start with p=reject?
No. Start with p=none to monitor without affecting delivery. Read the reports, confirm all your legitimate mail passes SPF or DKIM with alignment, then move to quarantine and finally reject.
What is the rua tag?
rua is the address where aggregate DMARC reports are sent, for example rua=mailto:[email protected]. These daily reports show which servers send mail as your domain and whether they pass authentication.
Does DMARC require both SPF and DKIM to pass?
No. DMARC passes if either SPF or DKIM passes and aligns with your From domain. You do not need both, but having both gives you redundancy if one breaks.

Keep reading

SPF CheckerValidate SPF + the 10-lookup limitDKIM CheckerValidate your DKIM public keyDMARC GeneratorBuild a DMARC record step by stepDNS Record CheckerLook up A, MX, TXT, NS in one click