DMARC policy at quarantine or reject in production

A DMARC record at p=none is monitoring mode only — it generates aggregate reports but does not instruct receiving mail servers to reject or quarantine spoofed email. Attackers can send phishing email appearing to come from your domain and it will land in inboxes unchallenged. RFC7489 requires p=quarantine or p=reject before DMARC provides any actual protection. Google's bulk sender guidelines for 2024 mandate DMARC enforcement for domains sending more than 5,000 messages per day; senders without enforcement face increasingly aggressive filtering at Gmail.

Publish a DMARC record at _dmarc.yourdomain.com with p=quarantine or p=reject. Graduate from p=none only after reviewing aggregate reports to confirm SPF and DKIM are passing. Add programmatic validation to your health check or CI pipeline:

export async function validateDmarcRecord(sendingDomain: string): Promise<void> {
  const records = await dns.resolveTxt(`_dmarc.${sendingDomain}`)
  const rec = records.flat().find(r => r.startsWith('v=DMARC1'))
  if (!rec) throw new Error(`No DMARC record at _dmarc.${sendingDomain}`)
  if (rec.includes('p=none')) {
    throw new Error(`DMARC for ${sendingDomain} is monitor-only — not enforcing`)
  }
}

A production-ready record: v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com; pct=100; adkim=s; aspf=s. Include both rua (aggregate) and ruf (forensic) reporting addresses and track these in infrastructure-as-code.