DMARC quarantine vs reject: which to use
p=quarantine sends fakes to spam, p=reject refuses them. When each one makes sense, how to move between them with pct=, and what can break.
Updated 20 Oct 2026. About 2 minutes to read.
Both policies act on mail that claims to be from your domain and fails DMARC. The difference is where it ends up.
p=quarantine | p=reject | |
|---|---|---|
| A fake from your domain | Lands in the spam folder | Is refused during delivery |
| Your own mail that fails by mistake | Lands in spam, so the recipient can still find it | Bounces, and you may get the bounce |
| Who sees the fake | Anyone who checks spam, which is a lot of people looking for a lost invoice | Nobody |
Use reject as the end state. Quarantine is the step before it, while you confirm that nothing you send still fails. A fake invoice in a spam folder is still a fake invoice someone may pay.
Moving from quarantine to reject
- Read a week or two of DMARC reports at p=quarantine. Every service that sends as your domain should show as passing, through DKIM or SPF.
- Change the record to
v=DMARC1; p=reject; pct=25; rua=mailto:.... A quarter of failing mail is rejected, the rest is still quarantined. - Raise pct to 50, then remove it (100 is the default) over the next weeks, if the reports stay clean.
Warnwell grades p=reject with pct below 100 as "Fake email goes to spam, not away", the same as quarantine, because part of the fake mail still gets through.
What can break at reject
- Mailing lists that rewrite messages. Most large list services now rewrite the From address so this works, but older ones do not.
- Forwarding from one mailbox to another breaks SPF. DKIM survives it, which is why DKIM on every sender matters before you switch.
- A forgotten sender: the old CRM, a website contact form, a scanner that emails PDFs. The reports find these if you read them first.
Domains that send no mail
Skip quarantine. There is nothing of yours to lose, so p=reject from day one is right.