What do my DMARC results mean?

You’ve run a DMARC check and got a result back. It might say no record, p=none, quarantine or reject. Here’s what each one means in plain English, how you compare with the 896 UK agencies, PR firms and architecture practices we checked in October 2026, and the one thing to do next.

What are the four DMARC results?

DMARC is a setting on your domain that tells email providers what to do with messages that claim to be from you but can’t prove it. Your result is the instruction you’ve given them.

Your result	What it tells email providers	Does it stop fake email?	Firms we checked
No record	Nothing. You’ve given no instruction.	No	18.3%
p=none	Deliver fakes as normal, and report them.	No	35.8%
p=quarantine	Send fakes to spam.	Mostly	27.6%
p=reject	Refuse fakes outright.	Yes	18.3%

More than half the firms we checked (54.1%) were in the first two rows. Nothing stops someone sending an email that looks like it came from them.

What does “no DMARC record” mean?

Your domain has no DMARC instruction at all. When a fake email arrives using your name, the receiving server has nothing from you to go on. It falls back on its own spam filters, and a well-written fake with no suspicious links can get through.

This was most common in architecture practices, where 31.3% had no record. It usually means DMARC was never part of the original email setup, not that someone decided against it.

Next step: ask your IT provider to add a DMARC record at p=none with a reporting address. It’s a five-minute change, and it starts the process.

What does p=none mean?

You have DMARC, but it’s set to monitor only. Fakes are still delivered, and you get a report about them the next day, if a reporting address is set and someone reads it.

p=none is a first step, not a finish line. It was the most common result in our research. More than half the firms on p=none had no reporting address, so nothing was being monitored at all.

Next step: find out who reads your DMARC reports, and when you plan to move to quarantine. Our post on what p=none means walks through how to move on safely.

What does p=quarantine mean?

Email that fails the check goes to the recipient’s spam folder instead of their inbox. That’s real protection: a fake invoice in a junk folder is far less likely to be paid than one in an inbox.

It isn’t complete. People do check spam, especially when they’re expecting something. And some providers treat quarantine loosely.

Next step: if your reports show nothing genuine failing, ask about moving to reject.

What does p=reject mean?

Email that fails the check is refused. It never reaches the recipient, not even their spam folder. This is the strongest setting, and fewer than one in five of the firms we checked had it.

Next step: keep it that way. Each time you add a new tool that sends email as you (a new CRM, a new e-signature service), make sure it’s set up to pass before it goes live, or its emails will be refused too.

What if my result mentions pct?

A record like this one only applies the policy to part of the failing mail:

v=DMARC1; p=reject; pct=25

Here, a quarter of fakes are refused and the rest are treated as if the policy were one step weaker. It’s a sensible way to tighten things gradually. If you’ve been on a partial setting for months, it has probably been parked rather than finished.

What if my record is invalid?

A record can exist and still not work. The two common causes are two DMARC records on the same domain, or a typo in the policy. Either way, email providers ignore it, so you’re effectively unprotected. It’s a quick fix for whoever manages your domain.

What do the SPF and reporting results mean?

Most checkers show two more things alongside DMARC.

• SPF lists the systems allowed to send email as you. It ends in -all (hard fail: anything else fails), ~all (soft fail: anything else is suspicious) or, rarely, ?all or +all (anything goes). Missing SPF, or two SPF records, needs fixing. Once your DMARC is at quarantine or reject, the difference between -all and ~all matters much less, because DMARC makes the final call.
• Reporting (rua) is the address that receives daily DMARC reports. Without it, you can’t see who is sending as you, which makes moving past p=none guesswork.

A public check can’t always see DKIM, the digital signature on your email, because it needs a name only your email system knows. If your checker can’t confirm DKIM, that doesn’t mean it’s missing.

Is my result the right domain?

Check the domain you actually send email from. Many firms have a website on one domain and email on another, such as studio.com and studiogroup.co.uk. It’s the one after the @ in your email address that matters.

What this means for your agency

Forward your result to whoever looks after your IT and ask two questions. Who receives our DMARC reports? When will we be at reject? A named person and a date mean it’s in hand. No answer usually means it was set up once and left.

If you haven’t checked yet, the checker at the top of this page shows your result in about a minute. If you’d like help reading your reports or planning the move to reject, we’re happy to talk it through.

Frequently asked questions

Does p=none count as having DMARC? Technically, yes. It meets Google’s and Microsoft’s minimum for bulk senders. But it doesn’t stop fake email being delivered.

Is quarantine good enough? It’s a big step up from none. Reject is better, because fakes never arrive at all.

Can p=reject block my real email? Yes, if a system that sends as you hasn’t been set up to pass. That’s why monitoring comes first.

How often should we check? Whenever you add or change a system that sends email as you, and at least once a year.

We’re a small firm. Do we need DMARC? Yes. Fake invoices target firms of every size, and smaller firms are less likely to have someone watching for them.

Sources

• Cubit Technology: DMARC adoption in UK agencies, October 2026
• Google: Email sender guidelines
• Microsoft: Outlook’s new requirements for high-volume senders
• RFC 9989: the current DMARC standard