Academy › Publishing › Domain and email
Don't switch to reject on day one: watch first, decide later
By the end, you'll have your DMARC policy set to monitor mode, you'll know what to look for in the report before leveling up, and you'll know what has to happen before you move to quarantine, and later, to reject.
By Yodai · Published on September 6, 2026 · Updated on October 12, 2026
SPF says who's allowed to send email on your behalf, and DKIM puts a signature on what you send. That leaves one question that isn't technical, it's a business call: when an email using your domain fails those checks, what should happen to it?
That answer is called the DMARC policy, and it has three levels. The mistake almost everyone makes is picking the toughest one on day one, figuring more protection is always better. It's not a knowledge problem. It's an ordering problem.
The three levels, and what each one does
No action (techies call it none) doesn't block anything. Every day, Gmail, Outlook, and the rest send you a report on what they've seen come through with your domain: who sent email, and whether it passed the checks or not. It's a camera, not an alarm.
Quarantine (quarantine) sends what fails to the spam folder. It's no longer just a camera: it's a door that closes halfway.
Reject (reject) drops the email before it reaches any inbox, not even spam. It's the door closed all the way.
The problem isn't which of the three you end up choosing. It's starting with the toughest one before checking what would break.
- It also blocks your own email if something fails without your knowing: an automatic notice from your website, an integration that sends from your domain that you forgot to declare
- There's no room to fix anything: the email never arrived, and you don't even know who missed out
- You close the door before knowing who was going to walk through it
- You get the report from each provider and see who's sending email with your domain, including things you didn't even know existed
- You fix what's failing without anyone noticing, because during those weeks nothing gets blocked
- You move up a level once the report stops bringing surprises, not before
Which one do I pick: You always start in monitor mode (none). You move to quarantine once the reports come back clean: Google's admin guide recommends watching them for at least a week, and two or three weeks is plenty. You move to reject only once quarantine, covering all your mail, stops turning up any new surprises.
- 1Weeks 1 to 3: just watch
You set the policy to monitor mode and let the reports come in. Don't change anything else. If something of yours is sending email under your domain that you never authorized, this is where you find out, without losing a single real email. - 2No surprises in the report: move to quarantine
You switch to quarantine, starting with just a portion of your mail, and ramp it up until it covers everything. Whatever fails goes to spam, it doesn't vanish. Keep checking the report every week. - 3Full quarantine with no new failures: reject
You move up to the final level. Now, whatever fails doesn't go anywhere at all. By this point, you already know the only thing failing is mail that was never really yours.
- Your domain's DMARC policy is set to monitor, not to block
- You know what to look for in the report before moving to quarantine, and when to move to reject
- You know why you never start with the door closed all the way
- The next lesson is exactly that report: what it contains and what to look for before it's too late