DMARC policy guide - none vs quarantine vs reject
What DMARC policy to set for cold outreach. Why Inboxlee defaults to quarantine.
On this page · 4
- The three policies
- The Inboxlee default
- Moving to p=reject
- Reading DMARC reports
DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receiving mail servers what to do when SPF and DKIM disagree with the visible From address. It also enables aggregate reporting of authentication failures back to the domain owner.
The three policies
The Inboxlee default
v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc@inboxlee.com; aspf=r; adkim=r
Quarantine is the right starting point for cold email. It gives you the protective signal of strict alignment without the brittleness of p=reject - which can bounce legitimate forwarded replies and CRM auto-responses during the first 14 days of warmup, when alignment occasionally hiccups.
aspf=r and adkim=r set relaxed alignment, which tolerates subdomain mismatches that strict alignment would reject. This is the right default for almost every cold sender.
Moving to p=reject
After 14 days of clean DMARC reports (no alignment failures from your real senders), you can move to p=reject. Inboxlee surfaces a "ready to upgrade to reject" prompt on the domain page once the report stream is clean.
Reading DMARC reports
We collect aggregate (rua) reports on your behalf and surface the parsed data in the deliverability dashboard. You see source IPs, alignment results, and volume per source - without parsing XML yourself.
A spike of unaligned mail from an unknown IP is worth investigating immediately. Could be a legitimate new tool that needs adding to SPF, or could be someone spoofing your domain. Either way, you want to know.