DMARC Policy

How it works

Domain owners almost always start at p=none — this is monitoring mode, and it lets you receive aggregate reports about who is sending under your domain without affecting any actual delivery. The first 14–30 days at p=none are critical: they reveal every legitimate sender that needs to be authorised and every shadow IT mail source you didn't know existed.

Once aggregate reports show that all legitimate senders are passing SPF or DKIM with alignment, the next step is p=quarantine, often combined with the pct= tag (e.g. p=quarantine; pct=10) to apply quarantine to only a percentage of failing mail at first. Quarantine is reversible: if a legitimate sender is missed, mail goes to spam rather than disappearing entirely. Finally, after another monitoring period, the policy progresses to p=reject — usually with pct=100 — at which point the domain is fully protected and no unauthorised sender can deliver under your name.

The sp= tag separately controls policy for subdomains, useful when subdomains are managed differently from the organisational domain.

Example