What Is DMARC and What Policy Should I Set?

DMARC (Domain-based Message Authentication, Reporting and Conformance) builds on SPF and DKIM by telling receiving mail servers what to do when a message fails those checks, and gives you visibility into who’s sending mail using your domain.

The three policy levels

  • p=none: monitor only — failing messages are still delivered, but you receive reports. The right starting point for any domain.
  • p=quarantine: failing messages are sent to spam/junk
  • p=reject: failing messages are rejected outright — the strongest protection against spoofing, but risky to enable before confirming all legitimate senders pass

Recommended rollout

  1. Start at p=none and review the aggregate reports for at least a few weeks
  2. Fix SPF/DKIM for any legitimate sending source that’s failing
  3. Move to p=quarantine, then eventually p=reject once confident nothing legitimate is being blocked

FAQ

Is it safe to jump straight to p=reject?

Not recommended — without first reviewing reports at p=none, you risk silently blocking your own legitimate email (e.g. a marketing tool not yet covered by SPF).

Updated at: .