The DMARC pct= tag controls what percentage of failing messages receive your DMARC policy. Setting pct=25 means only 25% of DMARC-failing messages get quarantined or rejected — the rest are treated as if your policy were p=none. This lets you gradually enforce your policy, catching misconfigurations before they affect all mail.
DMARC pct Tag: Gradual Rollout Strategy
How pct Works
The pct= tag tells receiving servers what percentage of DMARC-failing messages should receive your policy action:
v=DMARC1; p=quarantine; pct=25; rua=mailto:[email protected]
With this record:
- 25% of failing messages get quarantined (sent to spam)
- 75% of failing messages are treated as p=none (delivered normally)
- All passing messages are delivered normally regardless of pct
This is your safety valve. If a legitimate sender isn't authenticated, only a fraction of their messages get affected while you fix it.
The Rollout Strategy
Here's the timeline I recommend for advancing from p=none to p=reject:
| Week | DMARC Record | What Happens |
|---|---|---|
| 1-4 | p=none; pct=100 | Monitor only, no enforcement |
| 5 | p=quarantine; pct=25 | 25% of failures go to spam |
| 6 | p=quarantine; pct=50 | 50% of failures go to spam |
| 7-8 | p=quarantine; pct=100 | All failures go to spam |
| 9 | p=reject; pct=25 | 25% of failures rejected |
| 10 | p=reject; pct=50 | 50% of failures rejected |
| 11+ | p=reject; pct=100 or p=reject | Full enforcement |
When you omit the pct tag entirely, it defaults to 100.
Practitioner note: I've had clients who wanted to skip straight from p=none to p=reject. Don't do this. The pct= rollout exists because there are always surprises — a forgotten invoice system, a legacy marketing tool, a booking platform nobody remembers setting up. The gradual approach catches these before they cause real damage.
Monitoring During Rollout
At each stage, check your DMARC aggregate reports:
- Are legitimate senders still passing? Good — increase pct.
- Is a legitimate sender getting quarantined? Fix their authentication before increasing pct.
- Only seeing spoofing attempts in failures? Your configuration is clean — safe to advance.
Don't advance if you see any legitimate sender in the failure data.
When to Skip the Gradual Approach
You might not need the full pct= rollout if:
- Your domain only sends through one or two services
- You've already verified all senders have proper SPF and DKIM
- Your DMARC reports at p=none show zero legitimate failures for 4+ weeks
Even then, I'd still recommend at least one week at p=quarantine; pct=100 before jumping to reject.
Practitioner note: The domains where pct= rollout matters most are the ones with complex sending infrastructure — multiple ESPs, SaaS tools, and third-party services. If you're a GoHighLevel agency sending through five different services, don't rush the rollout. Each step change in pct reveals something you missed.
If you want help planning and executing a DMARC advancement timeline for your domain, I manage the full rollout process so you don't have to worry about breaking legitimate mail.
Sources
- RFC 7489: Domain-based Message Authentication (DMARC), Section 6.3
- Google: DMARC enforcement rollout
- dmarcian: Understanding the pct tag
- M3AAWG: DMARC Training Series
v1.0 · April 2026
Frequently Asked Questions
What does the DMARC pct tag do?
The pct= tag sets the percentage of failing messages that receive your stated policy action. pct=50 means 50% of failures get quarantined/rejected and 50% pass through as if p=none.
What should I set pct to?
Start at 25 when moving to p=quarantine. Increase to 50, then 100 over several weeks as you confirm no legitimate mail is affected.
What happens to mail not in the pct percentage?
Messages not in the pct percentage are treated as if your policy were one level lower. At p=quarantine with pct=25, the other 75% are treated as p=none.
Do I need pct=100 before moving to p=reject?
Yes. Stay at p=quarantine; pct=100 for at least 2 weeks before advancing to p=reject. This confirms that full enforcement at quarantine level causes no problems.
Can I use pct with p=none?
Technically yes, but it's meaningless. p=none doesn't take any action, so applying it to a percentage of messages has no effect.
Want this handled for you?
Free 30-minute strategy call. Walk away with a plan either way.