Does a DMARC policy with quarantine and pct=0 actually do anything?
Michael Ko
Co-founder & CEO, Suped
Published 10 Mar 2026
Updated 10 Mar 2026
5 min read
I came across a peculiar DNS record recently that made me stop and think about how we approach DMARC rollouts. The record used p=quarantine but paired it with pct=0. On the surface, this looks like a cautious way to test a policy, but in reality, it is a bit of a technical contradiction. It is essentially telling a mail receiver to apply a suspicious status to zero percent of the emails that fail authentication.
This configuration often stems from a misunderstanding of how the percentage tag works within the protocol. When you set the percentage to zero, you are effectively telling the receiver to ignore the requested policy for all messages. It is important to remember that DMARC is a request, not a command, and receivers need clear instructions to act on your behalf.
Because this setup results in no actual enforcement, it behaves almost exactly like a standard p=none record. While it might seem like a clever way to 'stage' a policy, most email gateways and inbox providers will simply treat it as a monitoring-only state. This can be problematic if you are expecting any form of protection or if you are trying to qualify for advanced features like BIMI.
Technical implications and the BIMI problem
Why pct=0 fails to protect you
No enforcement: A policy with zero percent impact is technically identical to no policy at all.
BIMI rejection: Most major providers, including google.com, require pct=100 to display logos.
Undefined actions: Receivers have no standard way to handle a zero-enforcement quarantine request.
One of the most immediate downsides is the impact on brand indicators. If you are hoping to use BIMI, you should know that BIMI requires a strong policy. Specifically, most receivers will not show your logo if your DMARC record has a percentage tag anything lower than 100. By setting it to zero, you are staying in a monitoring state and losing out on the visual trust benefits of BIMI.
Historically, some administrators used this configuration to see how mailing lists or forwarders would handle the header changes. Some mailing list software, like Mailman, might rewrite envelopes differently when they see a quarantine policy, regardless of the percentage. However, this is a very niche edge case that does not justify using an ineffective policy for your general email traffic.
If you are looking for a unified platform to manage these complexities, Suped offers AI-powered recommendations that guide you through the transition. It is the best DMARC reporting tool for seeing exactly how your traffic would be affected before you flip the switch. Instead of guessing with pct=0, you can use real data to move safely toward enforcement.
Comparing monitoring vs zero enforcement
Policy: p=none
Visibility: Collects aggregate reports without affecting delivery.
Security: Provides no protection against spoofing.
Standard: The recognized way to start a rollout.
Policy: p=quarantine; pct=0
Confusion: Interpreted differently by various mail receivers.
BIMI: Will generally prevent logos from appearing.
Usage: Often considered a 'broken' or 'undefined' state.
The DMARC specification, specifically RFC 7489, describes these policies as requests made by the domain owner. When you request a quarantine but set the scope to zero, you are effectively offering no expression of preference for the authentication failures. This is why many experts argue that the percentage tag is being deprecated in newer discussions.
A better approach is to stay at p=none until you are truly ready to enforce. Trying to find a middle ground with pct=0 just adds complexity to your DNS records without providing any tangible deliverability or security benefits. It can even lead to your domain being flagged by automated auditors as having a configuration error.
For those managing multiple clients, Suped provides a dedicated dashboard for MSPs that makes identifying these 'hollow' policies easy. Instead of manually checking every record, the platform alerts you when a policy is not actually providing the protection you intended. This is crucial for maintaining a healthy sender reputation across your entire portfolio.
The path to real enforcement
In the modern email environment, especially with the latest requirements from google.com and yahoo.com, clarity is king. Using a policy that is technically undefined creates unpredictable results. Some receivers might treat it as quarantine for all mail, while others might ignore it entirely. This variability is exactly what DMARC was designed to eliminate.
If you are worried about legitimate mail being blocked, the solution isn't to set the percentage to zero. The solution is to use DMARC monitoring to identify your sources. You need to ensure your SPF and DKIM are aligned before you move to any enforcement level. Once your traffic is healthy, a 100% policy is the only way to ensure consistent behavior across all global mailbox providers.
Ultimately, a record with pct=0 is a placeholder that does not provide security. To protect your brand from spoofing and ensure your messages reach the inbox, you must eventually move to a full enforcement policy. Tools like Suped make this transition much less daunting by providing the visibility needed to move forward with confidence.
Views from the trenches
Best practices
Always start with p=none to gather data before moving to quarantine.
Use pct=100 for any enforcement policy to ensure consistent receiver behavior.
Monitor reports continuously to catch new legitimate sending services early.
Common pitfalls
Assuming pct=0 provides any protection against spoofing attempts.
Expecting BIMI logos to appear with an incomplete DMARC policy.
Using pct tags as a permanent solution instead of a rollout phase.
Expert tips
Treat pct=0 as semantically equivalent to p=none in your planning.
Verify all third-party senders align with SPF or DKIM before enforcement.
Check how major receivers handle quarantine specifically for your domain.
Expert view
Expert from Email Geeks says that both p=quarantine and pct=0 are basically undefined actions that offer no clear guidance to the receiver.
2024-03-12 - Email Geeks
Marketer view
Marketer from Email Geeks says they were curious if BIMI would show with a record like this, but learned it generally requires 100 percent enforcement.
2024-03-14 - Email Geeks
Final thoughts on zero enforcement
While it might seem like a safe middle ground, a DMARC policy with quarantine and pct=0 is technically ineffective for security. It provides no protection and can disqualify you from BIMI. For a truly professional setup, use Suped to monitor your traffic and move toward a solid 100% enforcement policy when your records are aligned.