Best DMARC Policy for Small Business: none, quarantine, or reject?

Best DMARC Policy for Small Business: none, quarantine, or reject?

TL;DR: For most small businesses, p=reject is the right end state. It's the only policy that actually stops someone from spoofing your domain. p=quarantine works as a permanent choice if you genuinely can't verify every legitimate sender, and p=none should never stick around long-term since it's monitoring-only and blocks nothing. The real decision isn't which policy to start with (that's always p=none); it's which one to run once your reports are clean, and that comes down to how much spoofing risk your business can live with.

Most guides walk through the DMARC rollout path: start at p=none, move to p=quarantine, finish at p=reject. That part's well covered. What we hear more often from business owners is the question that comes after the monitoring window ends: which policy do I actually run, permanently? That's what this guide answers, organized by business type and risk level rather than rollout step.

For the DNS setup itself (records, syntax, registrar steps), see SPF, DKIM & DMARC: The Complete Setup Guide. This post assumes your records are already published and focuses only on the policy decision.

---

The three DMARC policies, and what "best" actually means here

"Best" doesn't mean "most aggressive" by default, and we'd push back on anyone who tells you otherwise. It means the strictest policy your sending setup can actually support without breaking legitimate mail. For most small businesses that ends up being p=reject, but the honest path there runs through p=quarantine first. A handful of real situations justify staying at p=quarantine longer than the standard 4-8 week rollout, and we'll get into those below.

---

Decision frame: which policy fits your business

Run p=reject if:

• You send from a small, known set of systems (your email host, maybe one marketing tool, one CRM) that you can fully inventory
• You handle customer payments, invoices, or sensitive data: the businesses attackers most want to spoof for phishing
• You're in a regulated or trust-sensitive field: law, accounting, finance, healthcare, real estate
• Your DMARC reports have been clean (no legitimate mail failing) for at least 2-4 weeks at p=quarantine

Stay at p=quarantine longer if:

• You send from many third-party tools (multiple marketing platforms, several SaaS integrations, contractor-run campaigns) and can't yet confirm all of them are SPF/DKIM-aligned
• You're actively onboarding a new sending tool and don't want a misconfiguration to bounce real mail during the transition
• Your reports still show occasional legitimate failures, since p=reject at this stage would drop real customer-facing email

p=none is never the answer for "what should I run": It's the correct starting policy for every domain, for 2-4 weeks, purely to collect reports. If you're asking "which policy is best," you've already moved past the point where p=none is the right permanent answer, since it provides zero protection against spoofing, which is the entire point of DMARC.

---

Best DMARC policy by business type

---

What happens if you pick the wrong policy

Stay at p=none too long and you get zero protection. Attackers can spoof your domain indefinitely while you sit on reports you're not acting on. p=none with nobody reading the reports is functionally identical to having no DMARC record at all.

Jump to p=reject too fast and legitimate mail starts bouncing. If a marketing tool or CRM isn't properly aligned with SPF or DKIM, p=reject will silently drop real customer emails, invoices, password resets, marketing campaigns, with no warning beyond a bounce report most people never check. This is the single most common DMARC mistake, and it's the entire reason the rollout window exists in the first place.

Sit at p=quarantine indefinitely without a real reason and you get partial protection at best. Spoofed mail lands in spam instead of the inbox, which stops most casual phishing but not a targeted attack. Plenty of recipients still check their spam folder, and quarantine doesn't carry the same domain-reputation signal to receiving mail servers that full enforcement does.

---

How to check if you're ready to move to a stricter policy

Before tightening from p=quarantine to p=reject, confirm:

1. Your DMARC reports show 100% alignment for at least 2-4 consecutive weeks: every legitimate sender passes SPF or DKIM.
2. You've inventoried every sending source: email host, marketing platform, CRM, help desk, invoicing tool, and anything else that sends mail using your domain.
3. No unexplained failures remain in your rua reports. An unexplained failure usually means a sender you forgot to authorize, not an attacker, but confirm before assuming either.

Not sure what your reports are actually saying? MailAfiniti's free DMARC record generator builds the correct policy string for wherever you are in this process and recommends the next step based on your current setup.

---

FAQ

What DMARC policy should a small business use?

For almost every small business, aim for p=reject. It's the only policy that fully stops someone from spoofing your domain. Get there by starting at p=none to monitor for 2-4 weeks, moving to p=quarantine once you've identified your legitimate senders, then flipping to reject once the reports come back clean. If you're running a complex, multi-tool setup, think e-commerce with a cart platform and shipping notifications, or a nonprofit juggling several fundraising tools, it's reasonable to sit at p=quarantine a bit longer while you verify every sender.

Is p=quarantine enough, or do I need p=reject?

Quarantine sends failing mail to spam, which stops most casual phishing but not a targeted attack, since plenty of people still check their spam folder and click anyway. Reject bounces failing mail before it's even delivered, which is the only way to fully remove that risk. If your business handles payments, sensitive documents, or a lot of client trust, law, finance, accounting, that kind of thing, p=reject is worth the extra setup verification it takes to get there.

How do I know when I'm ready to move from quarantine to reject?

Watch your DMARC aggregate (rua) reports for 2-4 consecutive weeks. Once every legitimate sender is passing SPF or DKIM alignment with nothing unexplained showing up, you're ready. If you're still seeing failures from a marketing tool or CRM you recognize, fix that sender's authentication first. Don't flip to reject until it's resolved.

Can I set different DMARC policies for different subdomains?

Yes, DMARC supports a separate policy for subdomains through the sp= tag, so you could run sp=reject on a subdomain while the root domain stays at p=quarantine. This comes in handy when a subdomain, say a marketing or testing subdomain, has a different set of senders than your main domain and needs its own timeline.

What's the risk of never moving past p=none?

Basically none of DMARC's actual protection. p=none only reports on spoofing attempts, it doesn't stop a single one, so mail claiming to be from your domain reaches the recipient's inbox exactly as if you had no DMARC record at all. The reporting only becomes useful once you act on it and tighten toward p=quarantine and eventually p=reject.

---

Related reading

• SPF, DKIM & DMARC: The Complete Setup Guide — full DNS setup, registrar steps, and the rollout mechanics this post builds on
• Emails Still Going to Spam After SPF, DKIM & DMARC? — when authentication passes but deliverability still fails
• Email Security Threats — what spoofing and BEC attacks actually look like without DMARC enforcement
• Email Deliverability Guide — inbox placement factors beyond authentication