Moving DMARC from p=quarantine to p=reject
p=quarantine tells receivers to treat failing mail as suspicious, which in practice means the spam folder. That is a real improvement over p=none, but the message is still delivered somewhere the recipient can find it.
p=reject is the end state: failing mail is refused at the SMTP transaction and never reaches the user at all. It is also the configuration that large receivers reward, and the prerequisite for BIMI.
If you have been at quarantine for a few weeks with clean aggregate reports, the move to reject is usually uneventful.
How to fix it
- 1Review the last two weeks of aggregate reports and confirm no legitimate source is still failing alignment.
- 2Pay particular attention to forwarded mail and mailing lists, which break SPF alignment by design — DKIM is what carries them.
- 3Change p=quarantine to p=reject and leave pct at 100.
- 4Watch reports for a further two weeks. Rolling back is a one-line DNS change if anything surfaces.
Check whether your domain has this problem
Free, no signup, about two seconds. You get the exact record to paste.
Related guides
- DKIM record with empty p= — a revoked key still in use
- SPF include points at a domain with no SPF record — a silent PermError
- DMARC record syntax errors that make receivers skip your policy
- DMARC external destination not authorized — why you receive no reports
- Two DMARC records at _dmarc — why your policy is being ignored