[{"data":1,"prerenderedAt":158},["ShallowReactive",2],{"seo-verification":3,"blog-dmarc-p-quarantine-email-deliverability-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-dmarc-p-quarantine-email-deliverability-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"publishedAt":20,"category":21,"categories":26,"featuredImage":28,"bgImage":29,"posterImage":30,"relatedSolution":28,"intro":31,"sections":32,"ctaTitle":109,"ctaBody":110,"ctaButton":111,"ctaUrl":112,"relatedPosts":113},345,"dmarc-p-quarantine-email-deliverability",{"fr":12,"en":10,"ar":13,"es":14},"dmarc-p-quarantine-email-delivrabilite","dmarc-p-quarantine-email-deliverability-ar","dmarc-p-quarantine-entregabilidad-email","DMARC p=quarantine: stop sending in monitor-only mode","In 2026, Google and Microsoft throttle senders of more than 100 emails\u002Fday stuck on DMARC p=none. SPF, DKIM, DMARC and List-Unsubscribe one-click checklist.",9,0,false,"2026-09-10T00:00:00+00:00",{"id":22,"name":23,"slug":24,"color":25,"icon":24},11,"Business Email","emails","bg-cyan-500\u002F10 text-cyan-400",[27],{"id":22,"name":23,"slug":24,"color":25,"icon":24},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fdmarc-p-quarantine-email-delivrabilite-poster.svg","A professional sends emails, they leave correctly — SPF and DKIM are in place — yet delivery rates drop, messages end up in spam or never arrive. Most of the time the domain is still on DMARC p=none: monitor mode with no effect on delivery. Since 2026, Google and Microsoft no longer just observe: they apply immediate throttling when the complaint rate exceeds 0.3%, and senders of more than 100 emails per day without an active DMARC policy face the consequences directly. Moving to p=quarantine is no longer optional — it is the minimum requirement.",[33,37,48,68,96,99,103,106],{"type":34,"title":35,"body":36},"h2","Why DMARC p=none is no longer sufficient in 2026","SPF and DKIM authenticate the sending: they prove a server was authorized and the message was not tampered with. But they give no instruction to the receiving server. DMARC decides: what does the receiving server do with an email that fails SPF or DKIM? In p=none, the answer is \"nothing\" — the email is delivered normally, and the domain owner receives reports. This observation mode made sense during initial deployment. In 2026, Google and Microsoft changed the rules: they actively read the DMARC policy of senders of more than 100 messages per day. A domain still on p=none is treated as a domain without a policy. The result: degraded delivery rates, preferential spam classification, and as soon as the complaint rate exceeds 0.3%, immediate throttling — the sending throughput is throttled server-side, with no explicit error on the sender side. Google Postmaster Tools' recommended threshold to stay under the radar is below 0.1%.",{"type":38,"title":39,"items":40},"ul","What you risk by staying on p=none after 2026",[41,42,43,44,45,46,47],"**Silent throttling** — Google and Microsoft cap message acceptance throughput from 0.3% complaints, with no explicit bounce.","**Systematic spam classification** — without an active policy, major mailbox heuristics treat your sends as unverified.","**Domain spoofing without protection** — a third party can send in your name; without active DMARC, recipients cannot distinguish genuine sends from fakes.","**Unused rua reports** — in p=none, reports arrive but nothing is blocked: you observe abuse without stopping it.","**Sender reputation loss** — a degraded reputation takes weeks to recover, even after correcting the policy.","**Email campaign blocking** — ESPs (Mailchimp, Brevo, SendGrid) refuse to send for domains with flagged reputations.","**Risk of forced escalation to p=reject** — Google may unilaterally apply a stricter policy if the domain is associated with phishing.",{"type":49,"title":50,"headers":51,"rows":55},"comparison","The three DMARC policies: p=none, p=quarantine, p=reject",[52,53,54],"Policy","Effect on failing emails","Use case",[56,60,64],[57,58,59],"p=none","Delivered normally — no action on the message. rua reports sent.","Initial observation phase (2-4 weeks maximum). No longer suitable for active senders in 2026.",[61,62,63],"p=quarantine","Directed to the recipient's spam\u002Fquarantine folder. rua reports sent.","Recommended intermediate step: active protection, but false positives remain accessible in spam.",[65,66,67],"p=reject","Permanently refused with SMTP 554 by the receiving server. rua reports sent.","Final goal: maximum protection. Reach it after 2-4 weeks in quarantine with no false positives.",{"type":69,"title":70,"steps":71},"steps","SPF + DKIM + DMARC + List-Unsubscribe checklist: 8 steps",[72,75,78,81,84,87,90,93],{"title":73,"body":74},"Verify the SPF record","Make sure a TXT record exists at the root of yourdomain.com and lists all your active sending sources. Example: `v=spf1 include:_spf.your-provider.com include:sendgrid.net ~all`. One SPF record per domain only — two simultaneous SPF records invalidate both. Check with `dig TXT yourdomain.com` or MXToolbox.",{"title":76,"body":77},"Verify the DKIM signature","Each sending source (main server, ESP, marketing tool) must sign messages with a DKIM key published in DNS. Example record: `mail._domainkey.yourdomain.com TXT \"v=DKIM1; k=rsa; p=MIGfMA0…\"`. Send a test message and check headers: look for `dkim=pass` in `Authentication-Results`. If multiple sources send in your name, each has its own selector.",{"title":79,"body":80},"Publish a DMARC record with rua address","Create a TXT record on `_dmarc.yourdomain.com`. If you are still on p=none, the starting value is: `v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; pct=100`. If you are ready for p=quarantine: `v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com; pct=100`. The `rua` field is the address that will receive daily aggregate reports. Without it, you fly blind.",{"title":82,"body":83},"Read an aggregate DMARC report (rua format)","Reports arrive as zipped XML files. Key fields: `source_ip` (sending server), `count` (number of messages), `disposition` (none \u002F quarantine \u002F reject), `dkim` and `spf` (pass or fail for each check). A report showing unknown `source_ip` entries with `dkim=fail` and `spf=fail` signals active spoofing of your domain. A legitimate `source_ip` with `spf=fail` signals that server is not listed in your SPF — add it before moving to p=quarantine.",{"title":85,"body":86},"Move to p=quarantine after 2 to 4 weeks of observation","Do not move directly to p=reject. The 2-4 week window in p=none then p=quarantine serves to identify overlooked legitimate sources: an external mailing list, a CRM tool, a newsletter from a subdomain. Moving directly to p=reject without this phase risks blocking your own sends if a legitimate source is not covered. Update the DNS: `v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com; pct=100`.",{"title":88,"body":89},"Add the List-Unsubscribe one-click header (RFC 8058)","Since 2026, Gmail and Outlook require senders of more than 100 emails\u002Fday to include the HTTP header `List-Unsubscribe-Post: List-Unsubscribe=One-Click` in their list-type messages (newsletters, campaigns). The complete header has two parts: `List-Unsubscribe: \u003Chttps:\u002F\u002Fyourdomain.com\u002Funsubscribe?id=abc123>` and `List-Unsubscribe-Post: List-Unsubscribe=One-Click`. Without this, Google displays an auto-generated unsubscribe button — less precise — and may downgrade your sender score. Most ESPs handle this automatically; verify your configuration enables it.",{"title":91,"body":92},"Monitor complaint rates in Google Postmaster Tools","Google Postmaster Tools (\u003Ca href=\"https:\u002F\u002Fpostmaster.google.com\">postmaster.google.com\u003C\u002Fa>) provides access to your domain's spam rate, sender reputation and delivery. Create an account, verify your domain via a DNS TXT record, and check the \"Spam rate\" dashboard daily. Target: stay below 0.1%. Between 0.1% and 0.3%, throttling risk. Above 0.3%, immediate throttling according to Google 2026 guidelines.",{"title":94,"body":95},"Move to p=reject once quarantine is stable","After 2 to 4 weeks in p=quarantine with no false positives in your spam folder and no unknown legitimate source in your rua reports, move to p=reject: `v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourdomain.com; pct=100`. This level protects your domain against phishing and meets the strictest requirements. Continue monitoring rua reports monthly.",{"type":34,"title":97,"body":98},"Reading and analyzing an aggregate DMARC report","An aggregate DMARC report is an XML file sent daily to the `rua=` address in your record. Each report covers 24 hours of sending from your domain, as seen by the receiving server (Gmail, Outlook, etc.).\n\nStructure of a report record:\n\n```xml\n\u003Crecord>\n  \u003Crow>\n    \u003Csource_ip>198.51.100.42\u003C\u002Fsource_ip>\n    \u003Ccount>1247\u003C\u002Fcount>\n    \u003Cpolicy_evaluated>\n      \u003Cdisposition>none\u003C\u002Fdisposition>\n      \u003Cdkim>pass\u003C\u002Fdkim>\n      \u003Cspf>pass\u003C\u002Fspf>\n    \u003C\u002Fpolicy_evaluated>\n  \u003C\u002Frow>\n\u003C\u002Frecord>\n```\n\nRead reports looking for three cases:\n\n- `dkim=pass` + `spf=pass` on your known IPs: your legitimate sends are passing correctly.\n- `dkim=fail` + `spf=fail` on unknown IPs: active spoofing — your reports document someone sending in your name without authorization.\n- `dkim=fail` on a known IP: this source sends in your name but is not covered by a DKIM key — fix it before moving to p=quarantine.\n\nTools like \u003Ca href=\"https:\u002F\u002Fdmarcian.com\">dmarcian.com\u003C\u002Fa> or \u003Ca href=\"https:\u002F\u002Fmxtoolbox.com\u002Fdmarc.aspx\">MXToolbox DMARC Analyzer\u003C\u002Fa> automatically read and aggregate these XML files to make monitoring operational.",{"type":100,"title":101,"body":102},"tip","Test before changing the policy","\u003Ca href=\"https:\u002F\u002Fwww.mail-tester.com\">mail-tester.com\u003C\u002Fa> sends a test email and returns a score out of 10 with a detailed report: SPF, DKIM, DMARC, blacklists, content score. Use it before and after every policy change. \u003Ca href=\"https:\u002F\u002Fmxtoolbox.com\u002Fdmarc.aspx\">MXToolbox DMARC Check\u003C\u002Fa> verifies the DNS record directly without sending. These two tools cover 95% of authentication-related deliverability issues.",{"type":34,"title":104,"body":105},"Troubleshooting: four common cases","**DMARC fails but SPF and DKIM each pass individually.** DMARC alignment requires that the domain in the `From` header matches the domain verified by SPF or DKIM. If you send from `sender@yourdomain.com` but your ESP signs DKIM with `otherdomain.com`, SPF and DKIM each pass — but DMARC fails due to non-alignment. Fix it by configuring your ESP to sign DKIM with your domain (`yourdomain.com`) or by adding the ESP's IP to your sending domain's SPF.\n\n**Empty rua report after 48 hours.** Check that the rua address belongs to the same domain as the DMARC record (or publish an authorization record on the external domain). Gmail and Outlook only send reports if your domain sends enough traffic to them — below a certain volume, no report is generated.\n\n**Rising complaint rate despite active DMARC.** DMARC protects authentication, not content. If recipients click \"Spam\", the DMARC policy cannot help. Check sending frequency, content relevance, and the List-Unsubscribe one-click header status: without easy unsubscribing, recipients use the spam button as an alternative.\n\n**List-Unsubscribe one-click not recognized by Gmail.** Gmail requires the HTTP POST form (RFC 8058): the header `List-Unsubscribe-Post: List-Unsubscribe=One-Click` must accompany the URL. A standalone unsubscribe link in `mailto:` or HTTPS without the `List-Unsubscribe-Post` field is not recognized as one-click. Check your ESP documentation to enable this option.",{"type":34,"title":107,"body":108},"From p=quarantine to p=reject: the path","Moving from p=quarantine to p=reject is the final step — and the easiest if the previous ones were done properly. At this point, all your legitimate sends pass SPF and DKIM, your rua reports show no unknown sources, and your complaint rate is below 0.1%.\n\nThe change is a simple value replacement in the DNS record: `p=quarantine` becomes `p=reject`. Standard TTL for DNS TXT records is 3600 seconds (1 hour): allow 1 to 4 hours of propagation depending on resolvers.\n\nWhy not go directly to p=reject without going through p=quarantine? In p=quarantine, false positives land in the recipient's spam — they are accessible and retrievable. In p=reject, they are permanently refused in SMTP: neither sender nor recipient can recover them. The intermediate phase acts as a safety net to identify the last misconfigured legitimate sources.\n\nAfter moving to p=reject, continue checking Google Postmaster Tools once a week during the first month, then monthly. A DKIM key rotation or a new ESP added without DKIM configuration can silently break alignment.","Configure DMARC from your control panel","ServOrbit web hosting includes cPanel DNS management: SPF, DKIM and DMARC are configured from the same panel, with no root access required.","Manage my DNS from cPanel","\u002Fhebergement-web",[114,129,143],{"id":115,"slug":116,"slugs":117,"title":121,"excerpt":122,"readTime":123,"views":18,"isPinned":19,"publishedAt":124,"category":125,"categories":126,"featuredImage":28,"bgImage":29,"posterImage":128,"relatedSolution":28},199,"spf-dkim-dmarc-passing-the-5000-email-threshold",{"fr":118,"en":116,"ar":119,"es":120},"spf-dkim-dmarc-delivrabilite-emails-pro","spf-وdkim-وdmarc-تجاوز-عتبة-5000-رسالة","spf-dkim-dmarc-superar-el-umbral-de-5000-correos","SPF, DKIM, DMARC: passing the 5,000-email threshold","Gmail and Outlook reject senders without aligned SPF, DKIM and DMARC with an SMTP 550 error. Here is how to configure all three records.",4,"2026-08-01T00:00:00+00:00",{"id":22,"name":23,"slug":24,"color":25,"icon":24},[127],{"id":22,"name":23,"slug":24,"color":25,"icon":24},"\u002Fblog\u002Fcovers\u002Fspf-dkim-dmarc-delivrabilite-emails-pro-poster.svg",{"id":130,"slug":131,"slugs":132,"title":136,"excerpt":137,"readTime":123,"views":18,"isPinned":19,"publishedAt":138,"category":139,"categories":140,"featuredImage":28,"bgImage":29,"posterImage":142,"relatedSolution":28},210,"bimi-display-your-logo-in-gmail-and-apple-mail",{"fr":133,"en":131,"ar":134,"es":135},"bimi-logo-marque-email-gmail-apple-mail","bimi-اعرض-شعارك-في-gmail-وapple-mail","bimi-mostrar-su-logo-en-gmail-y-apple-mail","BIMI: display your logo in Gmail and Apple Mail","BIMI displays your brand logo next to your emails in Gmail, Apple Mail and Yahoo. Full guide: DMARC requirements, VMC, CMC and DNS record.","2026-08-02T00:00:00+00:00",{"id":22,"name":23,"slug":24,"color":25,"icon":24},[141],{"id":22,"name":23,"slug":24,"color":25,"icon":24},"\u002Fblog\u002Fcovers\u002Fbimi-logo-marque-email-gmail-apple-mail-poster.svg",{"id":144,"slug":145,"slugs":146,"title":150,"excerpt":151,"readTime":17,"views":152,"isPinned":19,"publishedAt":153,"category":154,"categories":155,"featuredImage":28,"bgImage":29,"posterImage":157,"relatedSolution":28},331,"email-deliverability-on-vps-port-25-cold-ip-and-ptr",{"fr":147,"en":145,"ar":148,"es":149},"email-deliverabilite-vps-port-25-dkim-ptr","تسليم-البريد-الإلكتروني-على-vps-المنفذ-25-وـ-ptr","entregabilidad-de-email-en-vps-puerto-25-ip-fria-y-ptr","Email deliverability on VPS: port 25, cold IP and PTR","Port 25 blocked by the provider, fresh IP flagged as spam, missing PTR: the three structural blockers to resolve before your first send from a VPS.",1,"2026-09-05T00:00:00+00:00",{"id":22,"name":23,"slug":24,"color":25,"icon":24},[156],{"id":22,"name":23,"slug":24,"color":25,"icon":24},"\u002Fblog\u002Fcovers\u002Femail-deliverabilite-vps-port-25-dkim-ptr-poster.svg",1789046150981]