Does a DMARC 'pct' value of 0 mean no enforcement?

Yes, in practice, a DMARC policy with a percentage tag set to zero, like p=reject; pct=0;, means that no enforcement action (quarantine or reject) will be applied to your emails, even if they fail DMARC checks. However, it's not entirely the same as having no policy or using p=none. The key difference lies in the intent and the reporting data you receive.

Let's break down what the DMARC pct tag is and how a value of zero affects your email deliverability and security posture.

Suped DMARC monitor

Free forever, no credit card required

Get started for free

Trusted by teams securing millions of inboxes

When you configure a DMARC record, you're setting instructions for mail servers on how to handle emails that claim to be from your domain. Two fundamental tags for this are p (policy) and pct (percentage).

• Policy (p): This is the core instruction. It can be set to none (take no action, just send reports), quarantine (send failing emails to the spam folder), or reject (block failing emails entirely).
• Percentage (pct): This tag is an optional modifier that works with the quarantine and reject policies. It specifies what percentage of emails that fail DMARC checks should actually have the policy applied to them. The value can be anything from 0 to 100.

Zoho Zeptomail says:

Visit website

Pct refers to the percentage of emails to be affected by the DMARC policy and can take a value between 0-100. This is done to ensure a gradual rollout of the DMARC policy and test its impact.

The primary purpose of the percentage tag is to allow domain owners to enact a slow rollout of enforcement. Instead of immediately rejecting 100% of failing mail and risking the loss of legitimate messages, you can start small and gradually increase the percentage as you gain confidence in your email authentication setup.

When you set pct=0, you are telling receiving mail servers to apply your quarantine or reject policy to 0% of the emails that fail DMARC authentication. In effect, no emails will be quarantined or rejected based on your policy. They will be delivered as if your policy was p=none.

DuoCircle says:

Visit website

While you may be tempted to play it safe and enforce p=0, the thing is, setting the pct tag to 0 is as good as having no policy at all.

So, does this make the record useless? Not at all. Even with pct=0, DMARC is still active in a monitoring capacity. Receiving servers will still perform DMARC checks on your incoming email and, crucially, they will still send you DMARC aggregate (RUA) reports. These reports are the entire point of this initial phase. They provide invaluable data on which emails are passing and failing authentication, allowing you to identify and fix issues with your legitimate sending sources before you apply real enforcement.

Using pct=0 is a common and recommended step in a DMARC implementation project. The process looks like this:

• Start with `p=none`: Initially, you deploy a p=none policy to begin collecting DMARC reports and gain visibility into your email ecosystem.
• Move to an enforcement policy with `pct=0`: Once you have analyzed the reports and believe your legitimate mail is correctly configured, you can change your policy to p=quarantine; pct=0; or p=reject; pct=0;. At this stage, you're still not affecting mail flow, but you are signaling your intent to enforce and can continue to monitor reports.
• Gradually increase the percentage: As confidence grows, you can slowly raise the pct value. You might go from 0 to 5, then to 20, 50, and so on, checking your reports at each stage to ensure no legitimate mail is being impacted.
• Reach 100% enforcement: The final goal is to reach pct=100 (or remove the pct tag altogether, as 100 is the default). At this point, your DMARC policy is fully enforced, providing maximum protection against spoofing and phishing.

In summary, while a DMARC pct value of 0 does mean no enforcement action is taken, it's a critical and intentional part of a safe and methodical DMARC deployment strategy. It allows you to test the waters of a stricter policy without any of the risk.