Email authentication guide

DMARC p=none vs quarantine vs reject

p=none asks receiving servers to deliver mail that fails DMARC as normal and send you reports. p=quarantine asks them to treat it as suspicious, which usually means the spam folder, and p=reject asks them to refuse it. Start at none with reporting turned on, fix every legitimate sender, then tighten the policy in steps.

Check your DMARC record free SPF, DKIM and DMARC help

The basics

What a DMARC policy actually controls

DMARC is a TXT record published at _dmarc.yourbusiness.ca. When a receiving server gets a message that claims to be from your domain, it checks two things: did the message pass SPF or DKIM, and does the domain that passed match the domain in the visible From address? That match is called alignment. A message passes DMARC if at least one of SPF or DKIM passes with alignment.

The policy tag, p=, is your instruction for messages that fail. It doesn't change how your own mail is sent. It tells Gmail, Outlook and other receivers what you'd like done with mail that claims to be you but can't prove it. Receivers treat it as a strong request and still apply their own filtering, so passing DMARC is not a promise of the inbox.

Large mailbox providers now expect bulk senders to publish at least a p=none record. If the three records are new to you, start with our plain-English SPF, DKIM and DMARC overview. This page is about choosing and changing the policy.

Comparison

p=none vs p=quarantine vs p=reject

Policy	Receivers are asked to	What it protects	Risk to your own mail	Use it when
`p=none`	Deliver failing mail as they normally would, and send reports	Nothing directly. It gives you visibility.	Low. Failing mail meets the receiver's usual filters.	You're starting out or adding a new sending service.
`p=quarantine`	Treat failing mail as suspicious, usually the spam or junk folder	Forged mail is much less likely to reach an inbox.	Medium. A misconfigured legitimate sender lands in spam.	Reports show all your real senders passing.
`p=reject`	Refuse failing mail during delivery	The strongest protection against forging your exact domain.	Higher. A misconfigured legitimate sender bounces.	Quarantine has run cleanly for several weeks.

Example record

A starter DMARC record, tag by tag

A typical first record for a small business is a TXT record with the host name _dmarc (most DNS panels add your domain automatically):

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourbusiness.ca

v=DMARC1 must come first, exactly as written. p= is the policy for your main domain. rua= is where receivers send aggregate reports. You can list more than one address, separated by commas.

Later your record might look like v=DMARC1; p=quarantine; pct=50; sp=reject; rua=mailto:dmarc-reports@yourbusiness.ca. The pct and sp tags are covered below. adkim and aspf set alignment to relaxed (the default, where a subdomain counts as a match) or strict.

If the report address is on a different domain, such as a reporting service, that domain has to publish a record authorising it to receive your reports. Reputable services set this up for you.

Start at none

Why you start at p=none, and how to read the reports

Most small businesses send mail from more places than they remember: the mailbox provider, a website contact form, invoicing, booking or newsletter tools. If any of those sends as your domain without aligned SPF or DKIM, a strict policy would spam or bounce your own mail. Starting at p=none with an rua address shows you every source using your domain before anything is blocked.

Aggregate reports are XML files, usually sent about once a day by receivers that support DMARC reporting. Not every receiver sends them. Each report lists sending IP addresses, how many messages each sent, and whether SPF and DKIM passed and aligned. Raw XML is hard to read, so most people use a report viewer or reporting service that groups results by source. Sort what you see into three groups:

Yours and passing. Your mailbox provider and any tools already set up properly. No action needed.
Yours and failing. A real service you use that isn't aligned yet. Usually fixed by enabling DKIM with your domain in that service, or using its custom sending domain option.
Not yours. Unfamiliar sources sending as your domain. That's typically spoofing, and it's what quarantine and reject are for.

Forwarded mail and mailing lists can show up as failures even when the original was fine, because forwarding often breaks SPF and some lists alter messages in ways that break DKIM. A small amount of that is normal.

Rollout

Moving safely from none to quarantine to reject

List your sendersWrite down every service that sends email as your domain, including the website, invoicing, booking, newsletters and any scanner that emails documents.
Publish p=none with reportingAdd a single DMARC record with p=none and an rua address that you or a reporting service actually reads.
Fix alignment for each real senderTurn on DKIM signing with your own domain in each service, and make sure SPF lists only services you use. Recheck the reports after each change.
Wait for clean reportsKeep watching for at least a few weeks, long enough to cover monthly jobs such as invoice runs and newsletters.
Move to quarantineChange p=none to p=quarantine. For a gentler step, start with a lower pct value and raise it.
Move to rejectOnce quarantine has run without affecting your own mail, change to p=reject. Keep the rua address so you notice new problems.
Recheck when you add a toolA new service that sends as your domain needs aligned DKIM or SPF before it goes live.

pct and sp

Partial rollouts and subdomain policy

pct sets the percentage of failing messages the policy applies to. It defaults to 100 when left out. p=quarantine; pct=25 asks receivers to quarantine roughly a quarter of failing mail and handle the rest as if the policy were one step lower, which for quarantine means none. Not every receiver applies it precisely, so treat it as a gentle ramp rather than a precise dial and don't leave it below 100 for long.

sp sets the policy for subdomains such as news.yourbusiness.ca. If you leave it out, subdomains follow your main p= value. A subdomain that publishes its own DMARC record uses that record instead. If none of your subdomains send email, sp=reject stops anyone forging them. Check first, though: some newsletter and transactional email services send from a subdomain.

Common mistakes

DMARC mistakes that block your own mail

Two DMARC records. If a receiver finds more than one DMARC record for your domain, it ignores DMARC entirely. Edit the existing record instead of adding another.
Enforcing before every sender aligns. Jumping straight to quarantine or reject because a checker suggested it is a common way to send your own invoices to spam.
Record in the wrong place. DMARC belongs at _dmarc, not at the root of the domain. Typing the full name into a panel that adds the domain itself can create _dmarc.yourbusiness.ca.yourbusiness.ca.
Small typos. A missing semicolon or curly quotes pasted from a document can make the record invalid.
Expecting DMARC to fix spam on its own. It proves who sent a message. Content, reputation and the recipient's filters still matter. See why business email goes to spam.

You can see your current DMARC record with the free public email check. If your reports show legitimate senders failing and you'd rather not untangle it yourself, AIVIQ's authentication and deliverability repair starts at CAD $149 and covers SPF, DKIM and DMARC for one domain and up to three legitimate sending services. Existing DNS is recorded before any change.

Questions people ask

Is DMARC p=none useless?

No. It doesn't protect against spoofing on its own, but it turns on reporting so you can see every service using your domain, and large mailbox providers expect bulk senders to publish at least a p=none record.

How long should I stay at p=none?

There is no fixed rule. Stay until the reports show every legitimate sender passing with alignment over a period that includes your monthly or occasional sends. For most small businesses that means a few weeks or more.

Will p=reject stop all phishing that uses my business name?

No. It stops mail that forges your exact domain in the From address, at receivers that enforce DMARC. It does not stop lookalike domains or a free email account using your business name as the display name.

Can I have two DMARC records?

No. If a receiver finds more than one DMARC record for the same domain, it ignores DMARC for that domain. Combine everything into one record.

Do I need a paid DMARC reporting service?

Not necessarily. The reports are XML files you can read with free tools, but a reporting service groups them by sender and makes them much easier to act on. Prices vary, so check the provider.

What happens to forwarded email under p=reject?

Forwarding often breaks SPF, so forwarded mail usually depends on DKIM to pass. If DKIM is set up with your own domain and the forwarder doesn't alter the message, it normally still passes.

More email authentication help

See your current DMARC record in seconds.

The free check reads your domain's public SPF and DMARC records and shows what's missing. No signup, no password.

Run the free email check