Start DMARC at p=none to collect reports without affecting delivery, fix every legitimate sender that fails, then move to quarantine and finally reject. Use the pct tag to phase the change. Reject is the goal because it tells receivers to refuse mail that spoofs your domain.
The three policies
Google's documentation describes them this way.
- none: receivers take no action and deliver the message, but log it in reports sent to your reporting address.
- quarantine: receivers mark the message as spam and send it to the spam folder.
- reject: receivers refuse the message, usually with a bounce.
Staged rollout
Following Google's recommended order:
- Set up SPF and DKIM first and allow time before turning on DMARC. Google suggests 48 hours.
- Confirm third-party senders, such as marketing and ticketing tools, pass SPF and DKIM and align with your domain.
- Publish DMARC with p=none and a reporting address.
- Read the reports for a few weeks. Fix each real sender that fails.
- Use pct to apply the policy to a small share of failing mail, then raise it toward 100.
- Move from none to quarantine, then to reject, as confidence grows.
Reporting
The rua tag is optional but Google recommends always including it. Addresses need the mailto prefix and are comma separated. Reports can be heavy, so use a dedicated mailbox, a group or a reporting service rather than a personal inbox. If the report address is on a different domain, that domain needs a DNS TXT record authorizing it. Google notes Gmail does not support the ruf tag for failure reports.
Why engineers should care
Spoofed mail from your own domain is a tool for fraud against your customers, partners and staff. Gmail's sender guidelines say to set up SPF or DKIM for sending domains and recommend all three, SPF, DKIM and DMARC, for every domain. For bulk senders sending over 5,000 messages a day to Gmail, SPF, DKIM and DMARC are required, and the DMARC policy can be none. Keys need to be at least 1024 bits, with 2048 recommended.
Note the difference: meeting a bulk sender rule is not the same as being protected. A p=none policy lets spoofed mail through. Protection starts at quarantine or reject.
Common mistakes
- Jumping to reject before inventorying senders, which blocks real invoices and alerts.
- Forgetting parked or unused domains. Publish a reject policy for domains that never send mail.
- Leaving reports unread.
For the basics of each record, see SPF, DKIM and DMARC setup.
Quick check
Is p=none useless?
No, it is the right first step because it gives you reports. It just does not block spoofed mail yet.
Does DMARC stop lookalike domains?
No. It protects your exact domain. A different, similar looking domain needs other controls such as monitoring and registration.
Sources
Last reviewed: 19 October 2026.
