DMARC policies: p=none, p=quarantine, p=reject
The p= tag tells receivers what to do with mail that fails DMARC. What each policy does, how subdomain policy works, and why reject is the destination.
The p= tag in a DMARC record tells receivers what to do when a message fails DMARC. There are three options, and they represent a progression from passive monitoring to active enforcement. The policy only ever applies to failing mail: messages that pass DMARC with alignment are unaffected by even the strictest setting, which is why a correctly configured domain loses nothing by enforcing.
The three policies
p=none is monitor mode. Failing messages are delivered normally. The receiver sends reports if rua is set, but takes no action against the message. This is the starting point for every deployment, because it turns on visibility without any delivery risk.
p=quarantine tells receivers to treat failing messages as suspicious. In practice, this usually means they land in the spam or junk folder. The message reaches the server, but the recipient may never see it. p=reject means failing messages are refused at the SMTP level: the receiving server issues a 5xx rejection, and the message never reaches any folder. This is the strongest protection.
What happens to failing mail
| Feature | Delivery outcome | Protection level |
|---|---|---|
| p=none | Delivered normally | None; reporting only |
| p=quarantine | Spam or junk folder | Partial; spoofed mail still reachable |
| p=reject | Refused with a 5xx at SMTP | Full; spoofed mail never arrives |
Subdomain policy: sp and np
If the sp tag is absent, subdomains inherit the domain policy. Attackers often spoof subdomains like random.yourdomain.com, because they know the parent domain is what gets configured. Setting sp=reject early, even while the parent is still at quarantine, blocks this vector: real subdomain senders are usually few and easy to inventory, so subdomain enforcement is typically achievable long before parent-domain enforcement.
DMARCbis adds the np tag: a policy specifically for non-existent subdomains, ones with no DNS records at all. A record can now say p=quarantine sp=quarantine np=reject, cautious on real infrastructure while refusing mail from fabricated names like invoices.yourdomain.com that were never created. As receiver support spreads, np=reject is a low-risk hardening step, since a non-existent subdomain by definition sends no legitimate mail.
Choosing a policy honestly
p=none is a phase, not a destination: it satisfies the letter of the bulk sender requirements while providing zero spoofing protection. p=quarantine is better than none and weaker than reject, because spoofed mail might still reach recipients who check their spam folder. p=reject is where DMARC actually defends a domain, and the rollout entry describes the monitored path there. For domains that never send email, skip the progression entirely and publish p=reject on day one.
Frequently asked questions
Is p=quarantine a good long-term policy?
Do receivers always follow the published policy?
What happened to the pct tag for gradual rollout?
Will p=reject break my newsletters or transactional mail?
Key takeaways
- p=none monitors, p=quarantine folders failing mail as spam, p=reject refuses it at SMTP
- Policies only affect mail that fails DMARC; correctly authenticated mail is untouched at any level
- Set sp= deliberately: subdomain spoofing is a favourite attacker vector when only the parent is configured
- DMARCbis adds np= for non-existent subdomains, a low-risk early hardening step
- p=reject is the destination; p=none is a monitoring phase, and non-sending domains should publish p=reject immediately