What is DMARC policy?
A DMARC policy is the instruction in your DMARC record that tells receiving servers whether to deliver, quarantine or reject mail that claims your domain but fails authentication.
There are three settings. None means take no action and just send reports. Quarantine asks receivers to treat failing mail with suspicion, usually by sending it to spam. Reject asks them to refuse it outright.
Most domains start on none, read the reports to find every legitimate sender, fix the ones that fail, and then tighten the policy in steps. Jumping straight to reject risks blocking real mail from a tool you forgot about.
A stricter policy protects your brand from spoofing and is required for some features, such as showing a logo beside your messages. It is not a one-off task, because new tools and senders appear over time.
A worked example.
A hypothetical jewellery store publishes DMARC at none and finds in the reports that its review app sends as the domain without signing. It fixes that sender, waits, moves to quarantine, and later to reject once the reports show only legitimate, passing mail.
Common mistakes.
- Leaving the policy on none indefinitely
- Moving to reject before checking every legitimate sender
- Ignoring the reports that DMARC sends
Want this handled for your store? See our email deliverability service or book a free audit.
Find out what your list is actually worth.
We review your flows, list health, authentication records and last ninety days of performance, then send back what we found.
30 minutes, no obligation, and the findings are yours to keep either way.