What DMARC policy should a domain publish first?

Start at p=none with a rua= address so receivers send aggregate reports, and watch those reports for one to two weeks. Move to p=quarantine once every legitimate sender passes alignment, then to p=reject. Publishing enforcement before you have reports is how legitimate mail gets blocked.

What replaced the pct= tag in DMARC?

RFC 9989 (May 2026) removes pct= and adds the binary t= tag. t=y asks the receiver to apply the policy one level below the one you published — p=quarantine behaves as none, and p=reject behaves as quarantine. Receivers may ignore pct= entirely, so a staged rollout written with it no longer behaves the way its author intended.

Does a DMARC pass mean an email is not spam?

No. DMARC authenticates the domain in the From header; it does not score content, sender reputation, or user intent. A message can pass DMARC and still be spam, and a legitimate message can fail DMARC through a forwarder or a misconfigured sender. Spam filtering and authentication are separate layers.

Start free

Email authentication

Publish the policy that stops the spoof.

DMARC ties SPF and DKIM to the domain in your From line. Build a record below, or paste one to read every tag back in plain English — including the tags RFC 9989 retired.

Updated 8 November 2026

Your domainPublish at your organizational domain (example.com), not a subdomain. Used for the record name and the external-destination check.

Policy for the domain (p=)none Monitor. Ask for reports, enforce nothing. The correct first step.quarantine Suspicious. Failing mail is treated as spam.reject Invalid. Failing mail is refused. The end state, once reports are clean.

Subdomain policy (sp=)Absent, existing subdomains inherit p=. Set sp=reject once subdomains are covered.

DKIM alignment (adkim=)SPF alignment (aspf=)

Aggregate reports (rua=)Without this, receivers send no reports and failures stay invisible.Failure reports (ruf=) — optionalPer-message reports can contain content. Most large receivers do not send them.t=y testing — apply one level below the policy I wrote. p=quarantine behaves as none; p=reject behaves as quarantine. No effect at p=none.

What this policy does

DMARC proves the domain. It does not judge the message.

DMARC authenticates the domain in the From header. It does not score content, weigh sender reputation, or decide whether a message is spam. A message can pass DMARC and still be junk; a legitimate message can fail it through a forwarder, a mailing list, or a sender that signs as the wrong domain.

Passing SPF, DKIM and DMARC proves the mail is yours. It does not prove the mailbox provider wants it. If a legitimate transactional message lands in spam, the usual cause is a gap in SPF, DKIM or the alignment between them — see how to diagnose transactional email landing in spam, which maps the causes to the fixes; this generator builds the DMARC half.

Four policies, one direction

p=none

Monitoring. Collect reports, enforce nothing. A starting point, not a policy.

quarantine

Failing mail is treated as suspicious and usually routed to spam.

reject

Failing mail is refused outright. The end state once reports are clean.

t=y

Testing. Apply one level below the published policy. Replaces pct= in RFC 9989.

DMARC leans on the other two records. Check them with the SPF generator & checker and the domain health check, or run the deeper deliverability audit for MTA-STS, TLS-RPT, DANE and blocklists. Folio publishes and maintains all three for custom domains.

What changed in RFC 9989: pct= is removed — use t=y; ri= and rf= are historic; np= sets policy for non-existent subdomains and psd= is for public suffix operators.