DNS, Authentication, Setup
DMARC Policy for a Cold Email Domain: When to Move From none to quarantine to reject
p=none watches, p=quarantine sends failures to spam, p=reject blocks them. Start at none, read the reports for a few weeks, and only tighten once every legitimate sender passes.
6 min read
In this article
Start a new cold email domain at p=none, which only reports. Once the reports have shown for a few weeks that every legitimate sender passes DMARC, move to p=quarantine, and later to p=reject if you want failures blocked. Tightening before you have read the reports is how a legitimate sender, such as your sending tool, gets its mail rejected.
What each policy does
| Policy | What receivers are asked to do with failing mail | When to use it |
|---|---|---|
| p=none | Deliver as normal and send reports | A new domain, or any domain where you have not yet seen the reports |
| p=quarantine | Treat as suspicious, usually the spam folder | After the reports show every real sender passing |
| p=reject | Refuse the message | When you are confident and want the strongest protection against spoofing |
A safe order of work
- Publish v=DMARC1; p=none with an rua address you actually read. Reports are daily summaries from receivers listing who sent as your domain and whether SPF and DKIM passed and aligned.
- Let it run for a few weeks across a normal pattern of sending. Check each source in the reports: your mailboxes, your sending tool, your website forms.
- Fix any legitimate source that fails. The usual cause is a tool signing with its own domain, which fails alignment.
- Move to p=quarantine. The pct tag lets you apply it to a share of mail first, for example pct=25, then raise it.
- Consider p=reject once quarantine has run quietly for a while.
Does a cold email domain need more than p=none?
Gmail and Yahoo require a DMARC record for bulk senders, and p=none satisfies that requirement. A cold email domain does not usually receive spoofed mail pressure the way a bank does, so many teams stay at p=none for a while. The advantage of tightening is protection against someone sending as your domain. The risk is blocking your own tools. Pick based on which matters more for that domain.
Check the record
Use a DMARC checker to confirm the record parses, has one policy, and points reports to an address that can receive them. A common mistake is publishing two DMARC records, which makes both invalid.
Frequently asked questions
What DMARC policy should a cold email domain use?
Start at p=none, read the reports for a few weeks, and move to quarantine only once every legitimate sender passes. p=none already meets Gmail and Yahoo's requirement to publish a DMARC record.
What does p=quarantine do?
It asks receivers to treat mail that fails DMARC as suspicious, which usually means the spam folder.
Can I apply DMARC gradually?
Yes. The pct tag applies the policy to a percentage of failing mail, so you can start with a small share and raise it.
