How to Move DMARC From "None" to "Quarantine" Without Breaking Your Email

What you will need: access to your domain's DNS settings (usually through your domain registrar or web host), and an email address where you can receive reports.

If our free Email Setup Check told you DMARC is missing, or that your policy is p=none (monitoring only), this guide walks you through fixing it without losing legitimate email along the way.

What DMARC is, in plain English

DMARC is a short set of instructions you publish for the world to read. It tells other mail servers what to do with email that claims to be from your domain but fails certain checks. Those checks are called SPF and DKIM. Both are ways of proving a message really came from a sender you approved. Our guide on why your business emails land in spam and how to fix it explains both in plain terms.

DMARC has three policy settings:

• none: watch only. Mail that fails is still delivered, but you get reports about it.
• quarantine: mail that fails is sent to the recipient's spam folder.
• reject: mail that fails is blocked entirely.

"Policy" is just the setting that picks which of those three happens. It appears in your record as p=.

Why you don't jump straight to a strict policy

Your own email program isn't the only thing that sends email "as you." Other services may be doing it too, such as:

• Newsletter tools
• Invoicing or accounting software
• Website contact forms
• Scan-to-email copiers
• A CRM (customer relationship management software)

If any of these aren't set up properly, a strict policy will send your own legitimate mail to spam, or block it. That's why we move in stages: watch first, then quarantine, and only later consider reject.

Step 1: Check what you have today

Run the Email Setup Check on your domain. Its DMARC card will show one of two things:

• DMARC is missing. Go to Step 2.
• Policy: none. You already have a record. Skip to Step 3, but keep the rua= address from your existing record in mind (explained below).

Step 2: If you have no DMARC, publish a starter record

A DMARC record is a TXT record, a small piece of text stored in your DNS (the public settings that tell the internet where your website and email live). Add a new TXT record with these details:

• Name/Host: _dmarc. Some DNS providers want the full _dmarc.example.com instead, so check how your provider words it.
• Value:

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

Here is what each part means:

• v=DMARC1 says this is a DMARC record.
• p=none means watch only, so nothing changes about how your mail is delivered.
• rua= is where summary reports are sent. Mail providers such as Google and Yahoo email these to you, usually once a day, showing who is sending mail using your domain and whether it passed.

Reports are machine-readable files, not something you'd want to read by eye. A DMARC report reader service turns them into plain tables and charts. Many offer free or paid plans and give you a reporting address to use as your rua= address. When the reporting address is on a different domain than yours, that service has to publish a small permission record on its side before mail providers will send it your reports. Established report services handle this for you; if you use your own second domain, you'll need to add it yourself.

Only one DMARC record per domain. If there are two, mail providers treat your domain as having none. If you already have one, edit it rather than adding a second.

DNS changes usually show up within minutes to a few hours, but can take up to a day or two depending on your provider's settings. Re-run the Email Setup Check afterward to confirm the record is visible.

Step 3: Watch the reports for at least a week

Leave the policy at p=none and let reports collect. Google suggests about one week is usually enough to see all your regular mail. If your business has senders that only go out occasionally, like a monthly invoicing run or a quarterly newsletter, wait long enough to see each of them show up at least once.

Step 4: List every service sending as you

Using your reports, write down every service that sends email using your domain. Include the obvious ones (your main email) and the hidden ones from the list above. If you see a sender you don't recognize, ask around your office before assuming it's a problem. It could be a tool someone signed up for years ago. If nobody knows it, it may be someone else pretending to be you, which is exactly what DMARC is meant to catch.

Step 5: Make sure each sender passes

For each service on your list, it needs to pass SPF or DKIM using your domain. This is called alignment, meaning the domain that passed the check matches the domain in the "From" address. DMARC needs at least one of the two to pass and align. DKIM is the better one to rely on, because it keeps working when mail is forwarded.

In practice, this usually means going into each service's settings and finding something like "domain authentication" or "verify your sending domain." It will give you DNS records to add. Our spam guide covers the SPF and DKIM basics.

Keep watching the reports until every legitimate sender shows as passing. If a sender can't be set up to pass, consider replacing it before tightening your policy.

Step 6: Move to quarantine

When your reports show your legitimate senders passing, edit your existing DMARC record. Change p=none to p=quarantine:

v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com

You may see older guides suggest a pct= setting to apply the policy to only part of your mail. That setting was dropped from the DMARC standard in 2026, so don't add it. If your record already has one, you can remove it. The safer way to go gradually is the one in this guide: watch with p=none until your senders pass, then switch.

Step 7: Check your work

1. Wait for the DNS change to show up (usually minutes to a few hours).
2. Re-run the Email Setup Check.
3. The DMARC card should now show "Policy: quarantine."
4. Send yourself a few test emails from each service on your list, and confirm they land in the inbox, not spam.
5. Keep reading your reports for the next few weeks.

Rollback: if legitimate mail starts going to spam

Don't panic. This is easy to undo:

1. Edit your DMARC record and change p=quarantine back to p=none.
2. Figure out which sender is failing, using your reports or the message headers.
3. Fix that sender's SPF or DKIM setup (Step 5).
4. Once it passes, move back to quarantine.

Some mail servers remember your old record for a while, so a little mail may still be affected for a few hours after you roll back.

Later, and only if it makes sense: reject

The reject policy blocks failing mail outright. It gives the strongest protection against someone impersonating your domain, but mistakes cost more, since blocked mail is gone rather than sitting in a spam folder.

Consider it only after you've run on quarantine for a good while with clean reports, every sender is accounted for, and you're confident no new services will be added without being set up first. If your business is a frequent target for impersonation, such as fake invoices sent in your name, reject becomes more worthwhile. For many small businesses, quarantine is a solid place to stop.

If you'd like a hand with any of this, use the "Get help with this" button on your Email Setup Check results or send us a note through our contact form.