StopBouncingDMARC Policy Levels Explained
p=noneMonitor onlyEmail that fails DMARC is delivered normally. Use this while setting up and reviewing reports.
p=quarantineQuarantine failuresEmail that fails DMARC is sent to the spam/junk folder. Use after confirming all legitimate sources pass.
p=rejectReject failuresEmail that fails DMARC is rejected by the receiving server. Maximum protection — recommended end goal.
DMARC FAQ
What is DMARC?
DMARC (Domain-based Message Authentication, Reporting & Conformance) is a DNS policy record that ties together SPF and DKIM authentication. It tells receiving mail servers what to do with email that fails authentication checks — ignore it (none), move it to spam (quarantine), or reject it outright (reject). It also enables reporting so you can see who is sending email from your domain.
What DMARC policy should I use?
Start with 'none' (monitoring only) and set up a report address (rua=mailto:reports@yourdomain.com). Review the reports to identify all legitimate sources sending email from your domain. Once you're confident all legitimate sources pass SPF and DKIM checks, move to 'quarantine', then to 'reject' for maximum protection.
Is DMARC required?
As of 2024, Google and Yahoo require all bulk senders (5,000+ emails per day) to have DMARC configured with at least p=none. For most businesses, 'reject' is the recommended long-term goal as it provides the strongest protection against domain spoofing and phishing attacks using your brand.
What is pct in a DMARC record?
The pct tag specifies the percentage of failing email to which the policy applies (default is 100%). During rollout, you can use pct=10 to apply your quarantine or reject policy to only 10% of failing messages, gradually increasing to 100 as you gain confidence.