A DMARC policy tells receiving servers what to do with mail that fails authentication for your domain: p=none only monitors, p=quarantine sends it to spam and p=reject blocks it. The safe route is to start at none, learn who sends as your domain from reports, fix the legitimate senders, then tighten step by step.
What do the three policies do?
p=none: no action on failures. You receive reports. This is the starting point and meets the Gmail and Yahoo minimum for bulk senders.p=quarantine: failing messages are treated as suspicious, usually delivered to spam.p=reject: failing messages are refused during delivery. This gives the strongest protection against spoofing of your domain.
If you have not set up the underlying checks yet, begin with SPF, DKIM and DMARC explained.
How do you roll out DMARC safely?
- Publish
v=DMARC1; p=none; rua=mailto:[email protected]at_dmarc.yourdomain.com. - Collect aggregate reports for several weeks. A DMARC reporting service can turn the XML into readable dashboards.
- Identify every legitimate sender in the reports: marketing tools, support desks, billing systems. Add them to SPF and enable DKIM for each so that they align.
- Move to
p=quarantine. Thepcttag lets you apply the policy to a percentage of failing mail first. - Watch for legitimate mail landing in spam. Fix the sender and wait.
- Move to
p=rejectonce reports show only unauthorized sources failing.
What are alignment tags and the subdomain policy?
The adkim and aspf tags set strict or relaxed alignment. Relaxed, the default, lets subdomains of the same organizational domain match. The sp tag sets a separate policy for subdomains. If you send marketing from a subdomain, make sure its senders align before enforcing.
What mistakes break legitimate mail?
- Jumping straight to reject without reading reports.
- Forgetting a sender, such as a payroll or ticketing system, that sends as your domain.
- Exceeding the SPF 10-lookup limit while adding senders.
- Not signing with DKIM, so forwarded mail fails when SPF breaks.
How does DMARC enforcement relate to deliverability?
Enforcement protects your domain from spoofing, and it is a prerequisite for some brand features in inboxes. It does not by itself improve placement for your real mail, but the discipline of inventorying senders usually uncovers unauthenticated streams that were hurting you. See the Gmail and Yahoo requirements and our deliverability overview.
Frequently asked questions
Is p=reject required?
No. Gmail and Yahoo require a DMARC record for bulk senders, and p=none satisfies that. Reject is optional but offers the most protection.
What does rua mean in DMARC?
It is the address that receives aggregate reports, which summarize which servers sent mail as your domain and whether it passed.
How long should I stay at p=none?
Long enough to find all legitimate senders, often several weeks to a few months, depending on how many systems send for you.
Can DMARC block my own newsletters?
Yes, if the sending platform is not authenticated and aligned for your domain. That is why you check reports before enforcing.