DMARC p=none vs p=reject: which policy actually protects you?

DMARC has one setting that decides whether forged email is blocked: the policy, written as p=. Most domains that "have DMARC" sit at p=none — which blocks nothing. Here's what each policy does and how to reach p=reject safely.

What the DMARC policy controls

DMARC builds on SPF and DKIM: it checks that the visible "From" domain lines up with an authenticated sender, then tells the receiver what to do when that check fails. Reporting (rua=) tells you who's sending as you; the policy (p=) is what turns protection on.

The three DMARC policies

p=none — "monitor only"

The receiver takes no action on failing mail; you just get reports. It exists to gather data before you enforce — it is not protection.

p=quarantine — send failures to spam

Failing mail is marked suspicious and routed to junk. A useful stepping stone, but spam-folder placement isn't rejection.

p=reject — block forgeries outright

Failing mail is rejected at the server and never delivered. The only policy that genuinely stops impersonation.

Why "monitor only" is so common — and so risky

Turning DMARC on at p=none is easy and risk-free, so everyone starts there. Enforcement feels risky, so many organizations stop at none and assume they're covered. The dashboard looks green; the policy does nothing.

How to check your current policy

# Windows
nslookup -type=txt _dmarc.yourdomain.com

# Mac / Linux
dig txt _dmarc.yourdomain.com +short

A record looks like v=DMARC1; p=none; rua=mailto:reports@yourdomain.com. Two other tags matter:

sp= — the policy for subdomains. Missing or none lets attackers spoof anything.yourdomain.com.
pct= — the percentage of failing mail covered. Below 100 means some forgeries slip through.

Getting from none to reject without breaking mail

Stay at p=none with reporting on for two weeks; read the reports to find every sender.
Authenticate every legitimate sender with SPF and DKIM.
Move to p=quarantine, optionally ramping pct.
Move to p=reject at 100%, and set sp=reject for subdomains.
Keep it correct as you add new tools.

Frequently asked questions

Is DMARC p=none safe?

No. p=none is 'monitor only' — it reports on mail that fails authentication but tells inbox providers to take no action, so impersonators are not blocked. It's only useful as a temporary data-gathering step on the way to enforcement.

Will moving DMARC to p=reject block my newsletters or other real email?

Only if those senders aren't authenticated first. The safe path is to inventory every legitimate sender, set up SPF and DKIM for each, and move to reject in stages — so forgeries are rejected while your real mail keeps flowing.

What does the pct tag do in DMARC?

pct sets the percentage of failing mail the policy applies to (for example pct=25 applies to 25% of failing messages). It's used to ramp enforcement gradually, but it only delays full protection — the goal is still p=reject at 100%.

See your real DMARC policy in seconds

StopForge's free exposure scan reads your live records and shows exactly where your email authentication stands — what passes, what silently fails, and whether anyone can still send as your domain. No changes to your mail, no obligation.

See if your domain can be spoofed

← All guides