How to Enforce DMARC: The p=none to p=reject Guide

Publishing a DMARC record is the easy part; knowing how to enforce DMARC safely is the hard part. Moving from DMARC p=none to p=reject without breaking legitimate mail takes a staged, reversible plan.

A policy of p=none tells inbox providers to monitor and report, but to take no action on messages that fail authentication. It is a listening post, not a defense — until you reach an enforcing policy, spoofed mail using your exact domain can still land in inboxes. This DMARC enforcement guide walks that path step by step and shows you exactly when it is safe to tighten your policy at each stage.

Key takeaways

• p=none is monitoring only — it collects aggregate reports but blocks nothing, so your domain stays spoofable until you enforce.
• Move in order: p=none to p=quarantine to p=reject. Never skip quarantine.
• DMARC quarantine vs reject: quarantine sends failing mail to spam (recoverable); reject refuses it at SMTP (final, fully protective).
• You are ready to enforce when every legitimate sender aligns via SPF or DKIM and only unrecognized sources still fail.
• Use pct= to ramp enforcement and sp= to set subdomain policy independently.

Why p=none is only monitoring

DMARC builds on SPF and DKIM by adding two things they lack: alignment and a published policy. Alignment requires that the domain a recipient sees in the From: header matches the domain validated by SPF or DKIM. The policy tag, defined in the DMARC standard (RFC 7489), tells receivers what to do when alignment fails.

With p=none, the answer is “do nothing” — deliver as normal and, if a reporting address is configured, send aggregate data. That is genuinely useful for discovering every service that sends on your behalf, but it stops short of protection. Anyone can still forge your domain and reach recipients, because you have explicitly asked receivers not to act.

The scale of this gap is measurable. In ToolTrusted’s study of 10,000 domains drawn from the Majestic Million, 76.6% published a DMARC record but only 54% set an enforcing policy of quarantine or reject. In other words, roughly a third of domains that adopted DMARC stalled at monitoring and never captured the protection they set out to gain. Knowing how to enforce DMARC — and doing it carefully — is what separates a record that protects your brand from one that merely watches.

Step-by-Step Transition: DMARC p=none to p=reject

DMARC enforcement is deliberately incremental. The accepted route is p=none then p=quarantine then p=reject, and you should not skip stages.

Stage 1 — monitor (p=none). Publish a record and collect data long enough to see a full sending cycle, including monthly invoices, marketing sends, help-desk tools, and any third-party platforms. Your goal is a complete inventory of legitimate senders and confirmation that each one is aligned via SPF or DKIM.

Stage 2 — quarantine. The DMARC reject policy is not your first enforcing step; quarantine is. When you set p=quarantine, receivers send failing mail to the spam or junk folder rather than dropping it. This is the crucial difference in the DMARC quarantine vs reject decision: quarantine is recoverable. If a legitimate sender you missed starts failing, its mail is still retrievable from the recipient’s spam folder, giving you a chance to fix alignment before anything is lost.

Stage 3 — reject. With p=reject, receivers refuse failing mail outright at the SMTP layer. It never reaches the inbox or the spam folder. This is the goal — the point at which forged mail using your domain is stopped — but it is unforgiving of any sender you forgot to align. That is precisely why you arrive here last, and only after quarantine has been quiet.

How to enforce DMARC without breaking legitimate email

• Publish p=none with a valid rua= address and collect aggregate reports across at least one full billing and marketing cycle.
• Authenticate every sender you find — align SPF and add a DKIM signature whose d= matches your From: domain.
• Move to p=quarantine; pct=25, then ramp 25 → 50 → 100 while watching for any legitimate stream diverted to spam.
• Dwell at p=quarantine; pct=100 until failing sources are only spoofers, then set p=reject.
• Cover subdomains with an explicit sp= value, and re-check posture regularly with our email tools so drift back to none is caught early.

DMARC quarantine vs reject: Understanding the risks

The DMARC quarantine vs reject decision is really a risk trade-off. Quarantine’s risk is visibility: a legitimate stream you missed lands in spam, where recipients may still find it — annoying, but recoverable, and it gives you a signal to fix alignment. Reject’s risk is finality: that same missed stream is refused at SMTP and simply never arrives, with no spam folder to fall back on.

Quarantine therefore fails soft and reject fails hard, which is exactly why the safe path dwells at quarantine until the only failing sources are spoofers. If you are unsure where your domain stands today, run a free check on the email health platform to see your current policy and alignment before you tighten anything.

Implementing a strict DMARC reject policy

Readiness is not a calendar date; it is a data condition. You are ready to tighten policy when every legitimate sender is authenticating and aligning consistently, and no source of real mail is still failing DMARC. Practically, that means each sending service passes SPF with an aligned domain, or signs with DKIM using a d= value that matches your From: domain, or ideally both. Watch for the long tail: a quarterly billing system or a rarely used regional platform can be invisible for weeks.

DMARC aggregate reports are the evidence for this decision. ToolTrusted does not ingest or continuously process these reports for you — it measures public DNS posture, not your report stream — but our client-side DMARC Report Parser lets you open a single aggregate report in your browser to read who is sending and whether they align while you weigh each stage. When the failing sources you see are all illegitimate, you are ready.

Ramping with pct= and protecting subdomains with sp=

Two tags let you enforce gradually. The pct= tag applies your policy to only a percentage of failing mail — for example, p=quarantine; pct=25 quarantines a quarter of failing messages and treats the rest as none. Ramping 25 to 50 to 100 lets you observe the effect of enforcement on a controlled slice before committing fully.

Note a subtlety worth remembering: pct only ever downgrades the action for the unselected portion, and its handling has become less predictable across receivers, so treat it as a confidence-building ramp rather than a permanent setting.

The sp= tag sets policy for subdomains independently of the organizational domain. If you omit it, subdomains inherit the main policy. A common pattern is to keep p=reject on the root while a subdomain is still being brought into alignment, using sp=quarantine as a temporary bridge. You can generate correct, well-formed records for each of these scenarios with our DMARC generator.

Best practices for continuous DMARC enforcement

The core risk of DMARC enforcement is silently blocking legitimate mail from a sender you overlooked. De-risk it by advancing one stage at a time, dwelling at quarantine before reject, and using pct= to ramp.

Also plan for drift after you arrive: a well-meaning admin can weaken a policy back to p=none, or a new marketing tool can be added without alignment, quietly reopening the gap. ToolTrusted’s monitoring re-checks your published DNS on a schedule so a later downgrade or record change surfaces as a change you can see, rather than one you discover after a spoofing incident.

Over time, email deliverability analytics show whether your enforcement posture is holding or slowly drifting, so continuous DMARC enforcement becomes a trend you track rather than a box you tick once. Enforcement is not a one-time project; it is a posture you maintain.

Frequently asked questions

Does p=none provide any protection against spoofing?

No. A policy of p=none only asks receivers to monitor and, where configured, to send reports. Failing mail is still delivered normally, so someone can spoof your exact domain while the record is at none. Protection begins at p=quarantine and is complete at p=reject.

What is the difference between DMARC quarantine and reject?

Quarantine tells receivers to route failing mail to the spam or junk folder, where it can still be recovered. Reject tells them to refuse it outright, so it never arrives. Quarantine is the safer intermediate step because a legitimate sender you missed is still reachable; reject is the final, fully protective policy.

How do I know I’m ready to move to p=reject?

You are ready when every legitimate sending source authenticates and aligns via SPF or DKIM, and the only sources still failing DMARC are ones you do not recognize. Reviewing aggregate reports — for example with a client-side report viewer — confirms that no real mail stream is left unaligned before you enforce.

What does the pct= tag do during enforcement?

The pct= tag applies your policy to only a percentage of failing messages, letting you ramp enforcement gradually — for instance 25%, then 50%, then 100%. It builds confidence on a controlled slice of mail, though receiver handling of the tag varies, so treat it as a ramp rather than a permanent configuration.

Do I need a separate policy for subdomains?

Only if you want one. If you omit the sp= tag, subdomains inherit the organizational domain’s policy. Setting sp= lets you enforce p=reject on the root while a subdomain is still being aligned — for example sp=quarantine as a temporary bridge — so tightening the main domain never outpaces a lagging subdomain.