---
title: "What DMARC none, quarantine and reject really do"
url: "https://lookvalid.com/blog/security/dmarc-enforcement-gap-explained.md"
canonical_url: "https://lookvalid.com/blog/security/dmarc-enforcement-gap-explained"
last_updated: "2026-10-22"
type: "conceptual"
summary: "A DMARC record is a request, not a lock. See what p=none, quarantine and reject ask receivers to do and why a domain with a record can still be spoofed."
related: ["https://lookvalid.com/products/email-domain-check.md", "https://lookvalid.com/tools/dmarc-checker.md", "https://lookvalid.com/glossary/dmarc.md", "https://lookvalid.com/docs/api/email-domain-check.md"]
---

# What DMARC none, quarantine and reject really do

A DMARC record is a request, not a lock. See what p=none, quarantine and reject ask receivers to do and why a domain with a record can still be spoofed.

A DMARC record published at _dmarc.example.com tells mail receivers what the domain owner wants done with messages that fail authentication. It does not make the domain impossible to spoof, and many domains with a record are still wide open. This post explains each policy value, the settings that weaken it, and how our email-domain-check product reports them.

## What the three policy values ask for

The standard stores a domain owner's preferences as DNS TXT records in a `_dmarc` subdomain (section 6.1 of RFC 7489 [1]). The `p` tag carries the requested policy for mail that fails the DMARC check, and the standard words every value as something the owner wishes or requests, never as something it guarantees (section 6.3 [1]).

DMARC policy values and what a receiver is asked to do with failing mail

| Value | What the owner asks for | Practical meaning |
| --- | --- | --- |
| p=none | No specific action on delivery | Monitoring only. Failing mail is delivered as usual and reports can still arrive. |
| p=quarantine | Treat failing mail as suspicious | Receivers decide how, commonly spam folder or extra filtering. |
| p=reject | Reject failing mail | The strongest request. Receivers are asked to refuse the message. |

Three more tags change how far the policy reaches. `sp` sets the policy for subdomains only, and when it is missing the `p` value applies to them. `pct` is the percentage of the domain's mail the policy is applied to. `rua` lists the addresses that receive aggregate reports (all section 6.3 [1]).

## Why a domain with a record can still be spoofed

The gap between having a record and being protected comes from a handful of settings. Check for each of these before you treat a domain as safe.

- The policy is `none`. A record at this level only collects reports, so a forged message is delivered like any other.
- `pct` is below 100. The standard applies the policy to only that share of messages, so the rest are handled as if the policy were weaker.
- The subdomain policy is weaker. An explicit `sp=none` leaves every subdomain unprotected even when `p=reject` guards the main domain.
- Alignment is satisfied by the attacker. A message passes when SPF or DKIM validates a domain that matches the domain in the From address (sections 3 and 3.1 [1]). Strict and relaxed modes decide how closely they must match, so relaxed settings accept sibling subdomains under one organizational domain.
- Receivers may deviate. The standard says a receiver MAY choose to accept failing mail even when the policy is reject (sections 6 and 6.7 [1]), for example because of local allow lists.

DMARC also speaks only about the domain in the From address. A lookalike domain the attacker registered is a different domain with its own, usually empty, record, so no policy on your domain can stop mail from it.

## How email-domain-check reports DMARC

The product reads the TXT record at `_dmarc.<domain>` and returns the parsed tags in a `dmarc` object: `policy`, `subdomain_policy`, `pct`, `rua`, `valid` and a list of `issues`. Issue codes are `no_dmarc_record`, `multiple_dmarc_records`, `missing_policy_tag` and `invalid_policy_value`. It never contacts a mail server, and it does not test whether real mail would pass alignment.

One difference from a receiver matters. The standard has receivers retry at the organizational domain when the exact domain has no record (section 4.3 [1]). Our check reads only the name you send, so a subdomain with no record of its own is reported as `no_dmarc_record` even if its parent publishes a policy. Query the parent domain as well when you audit subdomains.

Look up a domain's DMARC and SPF settings

```bash
curl -X POST https://YOUR_API_HOST/v1/email-domain-check \
  -H "Authorization: Bearer $LOOKVALID_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain":"example.com"}'
```

The dmarc object from our captured example for example.com

```json
{
  "record": "v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s",
  "record_count": 1,
  "policy": "reject",
  "subdomain_policy": "reject",
  "pct": null,
  "rua": [],
  "valid": true,
  "issues": []
}
```

## Reading the result

- `policy` of `reject` or `quarantine` with `pct` null (no value published) or 100: the domain asks for enforcement. Check `subdomain_policy` next.
- `policy` of `none`, or `pct` below 100: the domain is observing, not enforcing. Treat mail claiming to be from it as unauthenticated.
- `valid` false with an issue code: the record is missing or malformed, so receivers have nothing to enforce.
- Empty `rua`: the owner receives no aggregate reports, so it is unlikely to learn about abuse.

Run a single domain in the free [DMARC checker](https://lookvalid.com/tools/dmarc-checker.md), or call the API from your own audit script. The [email-domain-check product page](https://lookvalid.com/products/email-domain-check.md) lists every field in the response.

## Sources

1. [RFC 7489: Domain-based Message Authentication, Reporting, and Conformance (DMARC)](https://www.rfc-editor.org/rfc/rfc7489.txt), read 2026-10-19

By LookValid engineering. Published 2026-10-19, updated 2026-10-19.

## Related

- [Email Domain Check API](https://lookvalid.com/products/email-domain-check.md)
- [Free DMARC checker](https://lookvalid.com/tools/dmarc-checker.md)
- [What is DMARC?](https://lookvalid.com/glossary/dmarc.md)
- [Email Domain Check reference](https://lookvalid.com/docs/api/email-domain-check.md)