When and How to Move from DMARC p=none to p=quarantine or p=reject

p=none is listening mode. You get reports, you accept everything, and you learn what is sending as your domain. The goal is enforcement, but jumping to p=quarantine or p=reject before you understand your mail flow breaks legitimate email and creates pressure to revert everything.

This guide covers the safe path: what to check first, how to move in stages, and what to do when something fails.

What p=none Actually Means

p=none tells receiving servers to accept all mail and send you aggregate reports. It enforces nothing. The policy value is in the reports, not in the servers' behavior.

If you have not read a single aggregate report, you are not ready to enforce. You need 30 days minimum of data before you can make an informed decision about what policy your domain can safely support.

The Three-Phase DMARC Rollout Model

Phase	Policy	Minimum Duration	Purpose
1	p=none	30+ days of reports	Learn your mail flow, fix alignment issues
2	p=quarantine	14-30 days	Test enforcement with reduced blast radius
3	p=reject	Permanent	Full protection against domain spoofing

Move through these phases gradually. Each phase gives you information the previous one cannot.

Before You Change Anything - Read the Aggregate Reports

Most enforcement failures come from skipping this step. In your aggregate reports, look for:

Legitimate senders that are not aligned: marketing platforms, transactional email services, internal relays, CRM systems
Percentage of mail that would be rejected: if more than 1-2% of your legitimate volume fails alignment, fix those senders first
IPs sending mail not in your SPF record: either misconfiguration or unauthorized use
Subdomains in your From header: if a subdomain sends mail and is not covered by your policy, it breaks when you enforce
Forwarding chains: forwarded mail often breaks alignment because the forwarder becomes the sender

You need high confidence that your aligned senders cover the vast majority of your legitimate volume before you publish a policy that can reject mail.

Step 1 - Move to p=quarantine

When your reports look clean and you have at least 30 days of data:

Update your DMARC TXT record with pct=10:v=DMARC1; p=quarantine; rua=mailto:your-reports@domain.com; ruf=mailto:your-forensics@domain.com; pct=10;
Set pct=10. Ten percent of failing mail gets quarantined. The other 90% passes through. You are testing.
Monitor aggregate reports daily for 7-14 days. Watch for user complaints about missing mail or mail appearing in junk.
If no significant issues appear, increase pct in steps: 10 -> 25 -> 50 -> 100.
Stay at each step for at least 7 days before advancing.
Do not move to p=reject until pct=100 at p=quarantine has been stable for 14+ days.

The pct tag is your safety valve. Each step gives you a chance to catch problems before they affect 100% of your mail.

Step 2 - Move to p=reject

Ready to make the final move when:

No user reports of missing mail after two weeks at pct=100 with p=quarantine
Aggregate reports show more than 99% of your legitimate mail passes alignment
Every marketing platform, transactional service, and internal system is documented and aligned
You have monitoring set up to catch new senders before they become problems

How to move:

Update your DMARC record, remove pct (defaults to 100%):v=DMARC1; p=reject; rua=mailto:your-reports@domain.com; ruf=mailto:your-forensics@domain.com;
Monitor aggregate reports daily for the first week.
Set up alerts for sudden spikes in DMARC failures. A spike means something new started sending as your domain.
Keep your rollback procedure ready: reverting to p=quarantine or p=none is a DNS update away.

What to Do If Mail Breaks After Moving to p=quarantine or p=reject

When legitimate mail starts failing:

Pull the aggregate report immediately. Identify the failing source and the authentication result (SPF, DKIM, alignment).
Determine whether it is a known legitimate sender or an unauthorized spoofing attempt.
If it is legitimate: fix the sender's SPF or DKIM alignment before continuing.
If it is urgent: lower pct temporarily or revert to p=none while you fix.
Document every new legitimate sender you find so it does not surprise you again.

Rollback is always just a DNS update. Do not let fear of rollback prevent you from enforcing.

Common Signs You Are Not Ready for p=quarantine

You have not read a single aggregate report in the past 30 days
Your mail flow includes forwarders and you have not checked how they affect alignment
Multiple subdomains send mail and not all are covered by your SPF or DKIM setup
Your marketing platform, transactional provider, or CRM is not aligned
Your users regularly forward work email to personal accounts for reply-from functionality

Fix these first. Each one is a landmine waiting to go off at the worst time.

How DMARC Monitoring Makes This Safer

Enforcement without monitoring is flying blind. The move to p=quarantine or p=reject is not a one-time decision. It is an ongoing commitment to watching your reports.

The rollout phases require monitoring at every step: daily checks when you first change policy, weekly as pct increases, and ongoing alerts once you reach p=reject. Without automated monitoring, you are waiting for users to tell you something broke. By then, it has already been broken for hours or days.

DMARCFlow parses aggregate reports automatically and alerts you when new senders appear that are not yet aligned, or when alignment failure rates spike unexpectedly. That means you catch problems early, before they become user-visible failures or before you advance to the next enforcement phase with unknown senders lurking in your reports.

If you are moving through the rollout phases, DMARCFlow is not optional - it is what makes the process safe enough to actually follow through on.

FAQ

How long should I stay at p=none before moving to p=quarantine?

At minimum 30 days of aggregate reports. Longer if you have many third-party senders, complex forwarding setups, or a history of not knowing what is sending as your domain.

Can I skip p=quarantine and go straight to p=reject?

Technically yes. The p tag accepts reject as a value directly. But if your domain has any unknown or misaligned senders, you will break legitimate mail fast. p=quarantine with pct=10 lets you test with minimal blast radius. Skipping it is a calculated risk, not a shortcut.

What does p=quarantine actually do?

It tells receiving servers to treat mail that fails DMARC as suspicious. Behavior varies by receiving server - most will route it to spam or junk, some may reject it outright. p=quarantine is softer than p=reject but still blocks a significant portion of spoofed mail.

How do I know if my email is being affected by my policy change?

Watch aggregate reports daily for the first two weeks. Watch for user complaints about missing mail or mail going to spam. If users start asking "did you get my email?" that is your signal to check the reports.

Should I use the pct tag?

Yes, when moving to p=quarantine. Start at pct=10 and increase gradually. When you reach p=reject, remove the pct tag entirely so it defaults to 100%.

This article is part of the DMARCFlow blog series on email authentication. DMARCFlow monitors your DMARC reports and alerts you when new senders appear or alignment failures spike, so you can fix problems before they affect deliverability.