The three policies
The p= tag in your DMARC record holds the policy. It acts only on mail that fails DMARC. Mail that passes is not affected by it.
p=none- Mailbox providers handle failing mail as they would without DMARC, and send you reports. Nothing changes for delivery.
p=quarantine- Mailbox providers treat failing mail as suspicious. That usually means the spam folder.
p=reject- Mailbox providers refuse failing mail while it is being delivered, and the sending server gets a bounce.
The policy is a request. Each mailbox provider decides under its own rules, and can handle a message differently.
Why you move in steps
A stricter policy acts on all failing mail, your own included. If a service you use fails DMARC, its invoices or newsletters go to spam or bounce along with the fakes.
So you move one step at a time, and only when your reports show that your own services pass.
Microsoft gives senders the same advice in its post on Outlook's requirements: “We advise moving gradually (none → quarantine → reject) to avoid unintended mail loss.”
4 steps from watching to refusing
Mailmoni suggests 4 steps. The ring on each shows the share of failing mail the step acts on.
-
Watch
p=noneMailbox providers deliver mail as they would without DMARC, and send you reports.
Ready from the first day.
-
Test
p=quarantine; pct=25Mailbox providers send 25 percent of the failing mail to spam.
Ready when the readiness rule holds. Before you move, the readiness page says about how many messages would go to spam.
-
Filter
p=quarantineMailbox providers send all failing mail to spam.
Ready when the rule still holds with the step before in place.
-
Refuse
p=rejectMailbox providers refuse failing mail.
Ready when the rule still holds. Before you move, the readiness page says about how many messages would be refused.
Some mailbox providers apply a partial policy to all failing mail or to none of it. At those providers, the 25 percent step sends all or none of your failing mail to spam.
About pct
The second step, p=quarantine; pct=25, uses pct, which asks mailbox providers to apply the policy to only part of the failing mail. pct comes from the first DMARC specification, RFC 7489.
RFC 9989, which replaced it in May 2026, removes pct. It says pct was usually not applied accurately except at 0 and 100, and lists the tag as historic. It adds a t tag for testing instead: t=y asks for the policy one step below the one stated.
When to take the next step
Mailmoni decides with one stated rule, the same for every step. It looks at the last 14 days of reports. The next step is ready when all of these hold:
- Reports arrived on at least 7 of those days.
- Every source with at least 50 messages or 1 percent of your mail passes DMARC at 98 percent or more.
- Unidentified sources that pass DMARC send under 1 percent of your mail.
- The DMARC, SPF and DKIM checks show no problem.
An unidentified source that never passes DMARC does not count against you. It is probably someone sending as you, and the stricter policy is what stops it.
From the Pro plan up, you can change these numbers for each domain.
The rule is checked again with each step in place. Before you move, the readiness page says about how many messages the next step would send to spam or refuse.
If something goes wrong, step back
Changing the policy is one edit to one DNS record, and so is undoing it. If mail you expected starts going to spam or bouncing after a step, put the record back to the step before.
Mailbox providers see the change when their cached copy of the record expires, after the time the record's TTL sets.
Then find the failing service in your reports, fix its SPF or DKIM, and wait until the rule holds again.