Home / Security / Tighten DMARC from p=none to p=quarantine
Email Deliverability · Security Ring

Tighten DMARC from p=none to p=quarantine

15 min, after a monitoring period Impact: high Effort: medium ✓ Manual completion

Moving DMARC from p=none (monitor only, no enforcement) to p=quarantine (suspicious mail gets sent to spam) is the real enforcement step that actually stops spoofed email from reaching inboxes, rather than just observing it happen.

p=none alone provides visibility but zero actual protection, tightening to quarantine is what converts DMARC from a monitoring tool into a genuine defense against domain spoofing.

The full picture

Progressing your DMARC policy from monitoring-only (p=none) to active quarantine enforcement (p=quarantine) represents the meaningful transition from passive observation to genuine, active protection against email spoofing — this is where DMARC's real enforcement value actually activates, rather than simply gathering data about your email ecosystem.

This progression should genuinely follow, not precede, the reporting and review work discussed in the related mission — moving to enforcement before you've reviewed real reporting data and confirmed all your legitimate sending sources are properly authenticated risks your own legitimate email being incorrectly quarantined due to configuration gaps you haven't yet identified and corrected.

The quarantine policy specifically instructs receiving mail servers to treat messages failing authentication with genuine suspicion — typically routing them to spam or junk folders rather than the inbox — providing real protection against spoofed email while remaining somewhat less aggressive than outright rejection, making this an appropriate, genuinely cautious intermediate step in your enforcement progression.

This represents real, meaningful security improvement once your underlying SPF and DKIM configuration has been verified as genuinely complete and accurate through the reporting data — the protection quarantine enforcement provides against spoofing attempts targeting your domain becomes genuinely active rather than merely theoretical once this stricter policy is actually applied.

How to do it

  1. 1
    Confirm you have reviewed DMARC reports first
    Only tighten enforcement after confirming every legitimate sending source is properly authenticated, this is why the DMARC reporting mission comes first.
  2. 2
    Update your DMARC record to p=quarantine
    A single value change in your existing DMARC TXT record.
  3. 3
    Monitor closely for the first few days
    Confirm no legitimate email is being incorrectly caught.
  4. 4
    Plan the eventual move to p=reject
    Quarantine is a real step forward, reject is the strongest final enforcement level once you are fully confident.

Common mistakes

How you will know it is done

DMARC policy is set to p=quarantine and legitimate email continues to deliver normally.

Track this in your hive

The Security Ring turns this into a real, permanent mission — mark it complete once you have genuinely done it.

Open this mission in H.I.V.E. →