← Back to Learn Decisions

When to move from p=quarantine to p=reject

Moving from p=quarantine to p=reject is the final enforcement step. It tells receiving servers to block unauthenticated emails entirely — they won't reach the inbox or spam folder.

When you're ready

Stable on quarantine for 14+ days — no reports of legitimate mail going to spam
Pass rate above 99% across at least 100 messages
All senders reviewed — no unknown senders in reports
No forwarding concerns — you've accounted for email forwarding and mailing list behavior
Organizational buy-in — stakeholders understand that reject blocks mail permanently, not just sends it to spam

What happens when you switch

Emails that fail DMARC are rejected outright — the sender gets a bounce notification
Recipients never see the failed email, even in spam
Spoofing of your domain is effectively blocked
This is the strongest DMARC protection level

Risks

Reject is permanent for each message — there's no spam folder to recover from. If a legitimate sender isn't properly authenticated, their emails will bounce and the sender will see a delivery failure. This is harder to diagnose than quarantine because recipients don't know the email was attempted.

Silent failures — unlike quarantine, recipients won't see rejected mail in their junk folder, so they can't report the problem
New senders — if your organization starts using a new email service, it must be configured for SPF/DKIM before it can send as your domain
Forwarding — forwarded mail that breaks DKIM will be rejected by the final recipient's server

Rollout checklist

Confirm quarantine has been stable for at least 14 days with no legitimate mail affected
Notify your organization that reject is being enabled
Consider starting with pct=25 to reject only 25% of failing mail
Monitor reports closely for 5-7 days
Gradually increase to pct=100
Document the process for adding new senders so future services are configured before going live

How to rollback

Change to p=quarantine or p=none. DNS propagation takes minutes to hours. During the transition, some servers may still reject based on cached records.