DMARC policy for cold email: none, quarantine or reject?

DMARC tells receiving mail servers what to do with a message that claims to be from your domain but fails authentication. For a cold email domain it does two jobs at once: it satisfies the Google and Yahoo bulk-sender requirement, and it is the strongest reputation signal you can publish. The question is not whether to publish it but which policy, and how fast to tighten it.

The three policies

Policy	What receivers do with failing mail	Use it when
p=none	Deliver normally, send you reports	You are still discovering which services send as you
p=quarantine	Put it in spam	Reports show every legitimate source passes
p=reject	Refuse it	Dedicated outbound domains, once quarantine is clean

p=none is monitoring, not protection. It satisfies the letter of the bulk-sender rules but tells receivers nothing about how much you stand behind your domain. Stay there only long enough to read the reports.

Step 1: publish p=none with reporting

_dmarc.yourdomain.com  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; adkim=r; aspf=r"

The rua address receives daily aggregate reports from every major receiver: which IPs sent as your domain, whether SPF and DKIM passed, and whether they aligned. Use a free or paid DMARC report viewer — raw XML is unreadable at any volume. Give it two weeks.

Step 2: fix alignment before tightening

Reports will show three kinds of sources: your mailbox provider (should pass and align), third-party tools sending as you (often pass DKIM with their own domain, so they fail alignment), and forwarding or spoofing (fails everything). Fix the second category by configuring each tool to sign with your domain's DKIM key or to send through your provider. Only when every legitimate source aligns should you move on.

Step 3: quarantine, gradually

Use the pct tag to apply the policy to a fraction of failing mail while you watch for collateral damage:

v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@yourdomain.com
v=DMARC1; p=quarantine; pct=50; rua=mailto:dmarc@yourdomain.com
v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc@yourdomain.com

A week at each step is enough. If a legitimate source starts landing in spam, the reports will show it as a new failing sender — fix it and pause the ramp.

Step 4: reject on dedicated outbound domains

A domain that exists only for cold email has no forwarding, no newsletters and no mystery senders. It should end at p=reject. This is the strongest reputation signal available: you are telling every receiver that anything failing authentication from this domain is not yours. Primary company domains often stay at quarantine for longer because of the breakages below.

What breaks, and how to avoid it

Forwarding

Mail forwarded by a recipient's server can lose SPF alignment (the forwarder's IP is not in your SPF). DKIM survives forwarding, so make sure DKIM is signing and aligned; DMARC passes if either mechanism aligns.

Third-party tools sending as you

Help desks, invoicing tools, calendar apps and CRMs that send from you@yourdomain.com each need to sign with your key or be routed through your provider. Every tool you add after the ramp is a new thing to check — re-read the reports for a week after any change.

Subdomains

Without a subdomain policy, subdomains inherit the parent policy. If you send cold email from mail.yourdomain.com and the parent is at reject, an alignment mistake on the subdomain is rejected outright. Either publish a separate _dmarc.mail.yourdomain.com record or set sp= on the parent to control it explicitly.

A note on DKIM record length

Many DNS hosts truncate or refuse TXT records over 255 characters, which is why 2048-bit DKIM keys sometimes “don't work”. Split the record into quoted chunks if your host supports it, or use a 1024-bit key published correctly — an unpublished 2048-bit key protects nothing. Quotarider publishes short keys through your DNS provider's API so this step passes first time.