DMARC for Cold Email: Exactly When to Move From None to Quarantine to Reject

What Each Policy Actually Does

• •p=none, "verify, but take no action." Failing mail still delivers normally; you get aggregate reports (rua) showing who's sending as your domain and whether it aligns. Zero protection, full visibility.
• •p=quarantine, failing mail goes to spam. Real protection, forgiving failure mode: a misconfiguration junks your mail rather than vaporizing it.
• •p=reject, failing mail is refused outright. Maximum trust signal, maximum blast radius if something's misaligned. Also the ticket to BIMI (with quarantine at pct=100 also qualifying).

The thing the one-line Reddit answers skip: DMARC doesn't check whether SPF and DKIM merely pass, it checks whether they pass with a domain that aligns with your visible From domain. A sequencer signing DKIM with its own platform domain passes DKIM and still fails DMARC. That's why enforcement without verification is Russian roulette with your own campaigns.

Phase 1, p=none Is a Listening Post, Not a Policy

v=DMARC1; p=none; rua=mailto:[email protected]

The rua tag is the entire point of this phase, skip it and p=none is just a checkbox. For 2-4 weeks, the aggregate reports answer three questions: Is every legitimate source (your sequencer, your inbox provider, anything transactional) passing? Is DKIM aligned, d=yourdomain.com, not the platform's domain? And is anyone else sending as you? Fix what the reports surface: usually it's enabling custom DKIM in Google Workspace / Microsoft 365 (walkthroughs in the Record Generator) and correcting the SPF include set, verify with the SPF Checker, and confirm end-to-end with a real send through the Header Analyzer.

Phase 2, Quarantine, Once the Reports Say So

v=DMARC1; p=quarantine; pct=25; rua=mailto:[email protected]
→ pct=50 after a clean week → pct=100

The gate is evidence, not courage: move when reports show effectively 100% of your genuine mail aligned and passing. After each pct step, send seeds to Gmail and Outlook and confirm dmarc=pass in the headers. Your own campaigns shouldn't feel anything, if they do, alignment wasn't actually done and quarantine's forgiving failure mode just saved you from finding that out at reject.

Phase 3, Reject, and Why It's Worth Finishing

After 2+ clean weeks at full quarantine, flip to p=reject. Beyond the marginal trust gain with providers (Microsoft's scoring in particular weighs enforced DMARC), reject closes the spoofing door completely, and spoofing is a cold emailer's hidden reputation risk. Secondary sending domains are attractive impersonation targets exactly because nobody's watching them; a spoof run against a p=none domain generates complaints that land on your reputation. Reject makes that impossible, permanently, for free.

Cold-Email-Specific Notes

• •Every sending domain gets the same treatment, the staged plan is per-domain, and secondary domains are the ones attackers pick.
• •sp= matters if you send from subdomains: the organizational policy covers them unless overridden; don't let sp=none quietly undo your enforcement (it also disqualifies BIMI).
• •Prewarmed infrastructure sidesteps the whole timeline, our domains ship with aligned SPF/DKIM and enforced DMARC on day one, which is precisely why they place the way they do.
• •Verify, don't assume: the DMARC Checker grades your current record and tags in ten seconds.