The DMARC ramp: none, quarantine, reject
DMARC is the rule on your domain that tells the world’s mail servers what to do with an email that claims to be from you but fails the checks. It has three settings. We turn it up one step at a time, because the top setting blocks mail, and a blocked real sender is worse than a week of watching.
The three settings
| Setting | What the receiver does with a failed email | What your portal says |
|---|---|---|
| none | Delivers it, and sends us a report | Monitor only |
| quarantine | Puts it in spam or junk | On, filtering |
| reject | Refuses it. It never lands | On, blocking |
No DMARC record at all shows as Off, with the finding “No spoofing protection on your domain”.
Why three steps
Your domain sends email from more places than you think: your mail provider, your website’s contact form, your invoicing tool, a newsletter service. At none, every receiver sends us a report of what it saw. After 7 to 10 days of reports we know every real sender and can list each one. Then we move to quarantine, watch another 7 to 10 days, and move to reject. Our system refuses to jump from none straight to reject, so a step can never be skipped by accident.
What you will notice
- At none. Nothing changes for your mail. The Domain Security card reads Monitor only with the finding “Spoofing protection is only watching”. Your score cannot reach 10 yet.
- At quarantine. Fake mail using your name starts landing in the receiver’s junk. If a real sender we missed is sending as you, that mail can land in junk too. Tell us and we add the sender. The card reads On, filtering with the finding “Spoofing protection is not fully on”.
- At reject. Fake mail bounces. The card reads On, blocking and the finding disappears. This is the only setting that scores a full 10 on the scan, together with a passing SPF and a found DKIM.
Who moves it
- Managed Domain includes the policy moves. We make each one from our side; you never touch a DNS record.
- Doing it yourself means you edit the record at each step. The order is the same. See SPF, DKIM and DMARC, done yourself.