When to Move from p=none to Quarantine or Reject in DMARC

Why p=none Is a Starting Point, Not a Destination

If you set up DMARC and left it at p=none, you have done the right thing by getting visibility first. But p=none is monitoring mode, not security. It tells receivers to do nothing with mail that fails DMARC. The only thing standing between your domain and spoofed email is whatever SPF and DKIM alignment is happening naturally.

Most practitioners move to p=none and then stall. They are not sure what the numbers in their aggregate reports mean, and they are afraid that switching to p=quarantine or p=reject will break legitimate email. That fear is reasonable. Moving too early without preparation can and does cause legitimate messages to disappear.

The question is not whether to move to enforcement. It is whether you have prepared enough to move safely.

The first step is reading your aggregate reports correctly. DMARCFlow collects and normalizes these reports so you can see which sources are passing, which are failing, and which you did not authorize, all in one view.

What p=none Aggregate Reports Tell You (and What Most Admins Miss)

DMARC aggregate reports arrive daily from participating receivers. They do not tell you which specific messages were delivered or blocked. They tell you which sources are sending mail on your behalf, which authentication results they got, and whether alignment passed or failed.

The numbers that matter most at the p=none stage:

Pass rate: What percentage of your mail passes both SPF and DKIM alignment? If fewer than 95% of your legitimate sources are aligned, moving to p=quarantine will likely cause problems.
Failure types: Are failures because sources are misconfigured, or because they genuinely cannot authenticate? Misconfigured sources can be fixed. Sources that structurally cannot authenticate may need to be moved to a subdomain or exempted.
Unknown sources: Who is sending mail from your domain that you did not authorize? This is the most important signal before moving to enforcement.

Most admins look at pass rate and nothing else. The unknown sources are the real risk. If you have marketing automation platforms, CRM tools, or legacy systems sending from your domain without proper authentication, those will fail at p=quarantine and get quarantined or rejected.

Readiness Checklist: Are You Ready for p=quarantine?

Before moving to p=quarantine, confirm the following:

1. Your aggregate reports show 95% or higher pass rate for all legitimate sending sources.
2. You have identified every source that sends mail from your domain. This includes marketing platforms, internal systems, legacy relays, and any third-party tools.
3. Every legitimate source either passes SPF and DKIM alignment, or has been documented and exempted via a subdomain strategy.
4. You have reviewed 30 days of aggregate reports to account for monthly send patterns. Some sources send only during billing cycles or quarterly campaigns.
5. Your help desk knows what to do if legitimate email stops arriving. Have a rollback plan ready.

If you cannot check all five boxes, stay at p=none and fix the gaps first.

How to Move to p=quarantine Without Breaking Email

The safest sequence is p=none to p=quarantine for 30 to 60 days before considering p=reject.

During the p=quarantine window, watch your aggregate reports daily. DMARCFlow alerts you to new sources and sudden pass rate drops, so you catch problems before they become user-facing email outages. Look for any sources that were not in your original inventory, and any sudden drops in pass rate. A new SaaS tool, an acquisitions IT system, or a shadow IT email tool will show up in this window.

If you see failures from a legitimate source that was previously passing, investigate immediately. DMARCFlow shows you the failing source, the authentication result, and the alignment status so you do not have to cross-reference raw reports manually. Common causes:

The source rotated its sending IP without updating SPF
A DKIM key was not renewed
A recent migration changed the sending infrastructure

The 30-to-60-day window is not arbitrary. It covers monthly reporting cycles and gives you time to spot sources that only send periodically.

Readiness Checklist: Are You Ready for p=reject?

Moving to p=reject is a permanent commitment. Unlike quarantine, where misaligned mail gets held for review, reject means the receiver discards it. There is no second chance for mail that fails at p=reject.

Before moving:

1. You have run at least 60 days at p=quarantine with zero false positives.
2. Every legitimate sending source has been audited within the last 90 days.
3. You have a documented exception process for any sources that structurally cannot authenticate, such as certain legacy mailing lists or some forwarded mail flows.
4. You have tested your own inbound email flow to confirm that mail your systems send to each other passes alignment.
5. Your security team has signed off on the change, because p=reject will block spoofed mail from external attackers. That is the point, but it also means a misconfiguration on your side will be silent and total.

If you have never enforced at any level, do not jump directly from p=none to p=reject. The quarantine phase is your safety net.

Can You Move Directly from p=none to p=reject?

Technically yes. DMARC policy values are independent. You can set p=reject at any time.

Practically, do not do this unless you are certain your sending infrastructure is perfect. Most organizations have at least one misconfigured or unknown source. The only way to find out is to monitor at p=none first.

There is one scenario where a direct move is defensible: when you have full control over every sending system and a complete inventory of sources. If you are a small organization with one email provider and no third-party senders, a direct move may be safe. For everyone else, use the quarantine phase.

What to Do When Legitimate Email Still Fails After the Move

If legitimate mail starts failing after you move to p=quarantine or p=reject, here is the sequence:

1. Pull your aggregate report immediately. Find the source that is failing and the reason for the failure.
2. Check SPF alignment: is the sending IP in your SPF record?
3. Check DKIM alignment: is the message signed with a domain that matches your From header?
4. If the source is a third party that cannot authenticate properly, either add them to your SPF record (if they provide a static IP range) or move them to a subdomain that does not share your DMARC record.
5. If you need to roll back quickly, set p=quarantine or p=none while you investigate. A rollback is not a failure. A silent email outage is.

The most common culprits are:

Marketing automation platforms that send from their own infrastructure under their own DKIM key

Internal systems that relay mail without authentication

Legacy CRM tools that send on behalf of users

Cloud platforms that rotate IPs and break SPF

How DMARCFlow Helps During the Transition and Beyond

DMARCFlow is built for exactly this scenario. Reading aggregate reports is tedious and easy to neglect. DMARCFlow monitors your DMARC data continuously, flags new sources, alerts you to sudden drops in pass rate, and tracks your readiness as you move through enforcement levels.

Before you move to p=quarantine, DMARCFlow gives you the full inventory of who is sending from your domain and which sources are failing. During the quarantine window, it surfaces anomalies before they become help desk tickets. After you move to p=reject, it monitors for spoofing attempts that your policy is now blocking.

The goal is to make the transition from p=none to enforcement boring and predictable, not a leap of faith. You do that by watching the data closely, and that is what DMARCFlow was designed to do.

FAQ

How long should I stay at p=none before moving to p=quarantine?

Stay at p=none long enough to capture at least one full cycle of every legitimate sending source. If you have monthly campaigns, quarterly billing sends, or annual promotions, you need at least 30 days, but 60 is better. If you have sources that only send quarterly, you need a full quarter of data.

What percentage of aligned mail should pass before I move to p=reject?

Aim for 99% or higher pass rate across all legitimate sources before moving to p=reject. At p=quarantine, 95% is a reasonable threshold because quarantined mail is not lost, just held. At p=reject, there is no recovery, so the threshold is higher.

What do I do if moving to p=reject breaks email for my marketing domain?

Move the marketing domain to a subdomain that has its own DMARC record. Your marketing platform likely cannot authenticate under your primary domain's DMARC policy. A subdomain with p=none or a relaxed alignment policy fixes this without weakening your main domain.

Can I move directly from p=none to p=reject?

Yes, but only if you have fully audited every sending source and are certain everything is correctly authenticated. For most organizations, the quarantine phase is a necessary safety net. If you are not certain, use p=quarantine first.

How do I use DMARC aggregate reports to prepare for the transition?

Look for three things in your aggregate reports before moving: the pass rate across all sources, the list of sources you did not authorize, and any sudden changes in send volume or authentication results. DMARCFlow aggregates this data and highlights the anomalies so you do not have to read raw XML reports.