DNS guides

DMARCWorks, should be fixed

DMARC p=none: when and how to move to quarantine or reject

p=none only monitors. Once reports show only your own services, move to p=quarantine and then p=reject to stop spoofing.

What it means

With p=none, receivers send you reports but treat mail that fails DMARC exactly as they would without DMARC. It's a monitoring mode.

p=quarantine asks them to put failing mail in spam; p=reject asks them to refuse it.

Why it matters for cold email

p=none is fine for sending, and it meets the Gmail and Yahoo requirement. Moving on protects the domain you've spent months warming up: with p=reject, nobody can send spoofed mail that passes as yours.

How to fix it

  1. Read a few weeks of reports. Every source that sends as you should pass SPF or DKIM aligned with your domain.
  2. Fix or remove anything that fails: a forgotten tool, a missing DKIM key.
  3. Change the policy to p=quarantine. You can phase it in with pct=25, then 50, then 100.
  4. After another clean stretch, change it to p=reject.

Stepping up from monitoring

Before

v=DMARC1; p=none; rua=mailto:[email protected]

After

v=DMARC1; p=quarantine; pct=100; rua=mailto:[email protected]

Questions

Will p=reject block my own cold email?

Only mail that fails DMARC, which means a sender you haven't authenticated. That's why you read reports first.

Related problems

Last checked 2026-10-21 against RFC 7208 (SPF), RFC 6376 (DKIM) and RFC 7489 (DMARC). Full setup guide

Sending cold email? Outsquid re-checks these records for every sending domain every hour, so a broken one doesn't go unnoticed. How deliverability works