All guides · Updated: 2026-10-18
DMARC: moving from p=none to p=quarantine without losing email
p=none is the right first step: DMARC watches, you get reports, and nothing is lost. But it doesn't stop anything either: fake email in your name still reaches the inbox. Of the Shopify stores we checked, 57.6% had DMARC stuck at p=none.
This guide says when it's safe to take the next step and how to take it. We're going down the same path with our own domain.
What changes
p=none: mail servers do nothing differently. They just send you reports.p=quarantine: an email that claims to be from you and fails DMARC goes to spam.p=reject: that email is refused and never gets in.
An email passes DMARC if it passes SPF or DKIM with your domain. One of the two is enough.
When it's safe to switch
When every service that sends email as you passes DMARC. Make the list:
- Your email (Google Workspace, Microsoft 365 or another).
- Your store or site: order confirmations, contact forms.
- Newsletters and marketing (Klaviyo, Mailchimp, Brevo…).
- Invoicing, CRM, customer support, bookings: anything that sends email with your address.
For each one, make sure DKIM is on with your domain. It's the safest option, because it doesn't break when an email is forwarded. It usually takes 2 to 4 weeks of p=none to be sure.
Step 1: confirm with the reports and a test
The reports sent to the rua= address tell you, day by day, which servers sent email in your name and whether they passed. They come as technical files, but free tools summarise them, and each one explains what address to put in rua=:
- Postmark DMARC: a weekly summary by email.
- Cloudflare DMARC Management: if your domain's DNS is on Cloudflare.
What to look for: your own services failing. Those must be fixed before the switch. Unknown servers failing are often exactly the fake emails the switch will stop.
Quick test: send an email from each service to a Gmail account, open it, click the three dots › Show original and check that the DMARC line says PASS.
Step 2: change the record
In your DNS panel, edit the _dmarc TXT record you already have (don't create another: there can only be one) and replace p=none with p=quarantine:
- Type
TXT- Name (host)
_dmarc- Value
v=DMARC1; p=quarantine; rua=mailto:dmarc@yourcompany.com
Keep the rua=: you'll need the reports to see what happens next.
Step 3: watch the first few weeks
Over the next 2 to 4 weeks, look at the report summaries and ask the people you work with whether any genuine email has started going to spam, such as order confirmations or invoices.
If something genuine fails, go back to p=none while you fix that service. The change takes minutes to hours, and going back loses nothing.
After the switch, check the domain: the warning “Your rule against fake email is only watching” goes away.
What about p=reject?
p=quarantine already takes fake email out of the inbox. p=reject is the final step, where it never gets in at all: it's only worth it once the reports have been clean for weeks at p=quarantine.
Mistakes we see often
- Switching on day one, without looking at the reports: invoices or newsletters start going to spam.
- Creating a second
_dmarcrecord instead of editing the existing one. With two, DMARC is ignored. - Deleting the
rua=during the switch: you lose any way of seeing what's failing. - Forgetting a service that rarely sends, like monthly invoicing: nobody notices until its email fails.
So you don't have to check again
If someone sets p=none again or deletes the _dmarc record, nobody notices. Excubitor can watch the domain every week and email you only when something changes. Free for 1 domain: run the check and press “Notify me”.