What happens when DMARC uses sampling with pct=0?

You’re confident your domain’s DMARC record is set to reject forged emails. You've enforced it with p=reject. But what if one tiny detail—setting pct=0—means your enforcement doesn’t actually run on a single email?

That’s the quiet trap. The pct tag controls real-world enforcement sampling. With pct=0, DMARC says: “Check all messages for alignment, but take no action—no rejection, no quarantine.” It’s not security. It’s audit mode, disguised as policy.

Key takeaways

  • Setting pct=0 in a DMARC record disables enforcement on all emails, even when p=reject is configured.
  • DMARC still logs alignment failures when pct=0, but no delivery actions are taken on those messages.
  • Using pct=0 in production creates a false sense of security—attackers can exploit unenforced domains without detection.

How does DMARC percent sampling actually work under the hood?

DMARC uses a randomized, per-message sampling mechanism to enforce policies like pct=90—only about 90% of incoming emails are checked against SPF and DKIM alignment, with each message having an equal, independent chance of being evaluated. This prevents over-blocking during rollout and lets domains gradually test enforcement without disrupting legitimate mail.

Randomized, Message-Level Sampling

When a domain sets pct=90 in its DMARC record, the receiver doesn’t analyze every email—it randomly picks roughly 90% of messages to validate. The selection isn’t based on sender IP, recipient, or content. It’s purely probabilistic, using a cryptographically sound random number generator built into the DMARC process.

You might see a legitimate email from your provider get flagged one day, not the next—just because it was randomly selected. This unpredictability protects against abuse and avoids bias in enforcement.

Gradual Testing Without Disruption

That randomness is key. It lets you test DMARC enforcement at scale without risking delivery for your real users. Start with pct=10, observe reports, and slowly increase as you verify alignment and sender reputation. The same mechanism applies to pct=0, which is often used legally just to collect reporting without enforcing anything.

Even with pct=0, you still get DMARC aggregate and forensic reports—useful for spotting spoofing attempts or misconfigured mail flows. This gives visibility without blocking a single message.

This isn’t just theory. RFC 7483 (the standard defining DMARC) explicitly specifies that the pct tag represents a percentage of messages to which the policy applies, with exact enforcement decided per message through sampling.

If you're validating email domains at scale—whether for a campaign, a list, or a pipeline—understanding how pct=0 works helps you interpret DMARC reports correctly. You can test your own domain alignment across real messages using inbox placement testing tools to see if you're vulnerable to spoofing, even with low enforcement.

Test inbox placement with real sender reputations and DMARC alignment, or use the real-time verification API to validate individual addresses and catch invalid or risky ones before they hurt deliverability.

Why is using pct=0 a stealth risk to deliverability?

Setting pct=0 in your DMARC record disables enforcement for all messages, meaning even if an email fails SPF or DKIM, the receiving server still accepts it. This creates a silent loophole where spoofed, misconfigured, or malicious emails can arrive in inboxes using your domain name without consequence—eventually eroding sender reputation.

The invisible cost of no enforcement

When pct=0, your domain’s DMARC policy becomes a passive observer. Messages that fail authentication are logged by receiving servers but not rejected or quarantined. This is not a configuration error—it’s an intentional choice that trades safety for perceived email volume. However, every passing bad message contributes to a growing signal of inconsistency in your domain’s authentication reputation.

Even if an email is sent from a compromised account or a phishing campaign spoofing your domain, DMARC does nothing. The receiving server treats it like a valid message and delivers it. Over time, this behavior shows up in aggregate reports from large ISPs like Google or Microsoft, which monitor alignment failures and sender consistency. A domain with frequent alignment mismatches but no enforcement can be flagged as unreliable—even if you have no legitimate sending volume.

According to RFC 7483, DMARC is designed to allow domain owners to observe authentication performance while gradually enforcing policy. A zero enforcement percentage undermines that purpose. While the intention may be to avoid breaking existing workflows under the pct=0 policy, the long-term side effect is an unchecked degradation of domain trust.

How this harms deliverability

Every email that passes with a failed alignment but no rejection adds noise to your domain’s reputation profile. ISPs use machine learning models to assess sender trust, and inconsistent authentication behavior—especially when bad messages are allowed to deliver—increases the risk of inbox placement issues, even for clean mail.

It’s a stealth risk because you won’t see immediate bounces or blocks. The damage accumulates silently. You’re not violating a policy—you’re enabling the conditions that lead to one. This is why major platforms include DMARC enforcement compliance in their sending evaluation workflows.

If you’re using DMARC with pct=0, it’s worth running a full inbox placement test to see how your domain appears to real inboxes. You can test your sender reputation and detect misaligned or spoofed traffic using our inbox tester: inbox placement test.

Can you use pct=0 in production without risk?

You can technically publish a DMARC record with pct=0 and p=reject, but doing so offers no real protection. The policy never enforces because 0% of messages are subjected to rejection. This leaves your domain vulnerable to spoofing, and receiving servers see no need to apply filtering since no enforcement is active. It’s not a safe configuration for production use.

Why pct=0 isn't a safe fallback

DMARC’s pct tag is designed to control how often a policy is enforced—not to disable it entirely. Setting pct=0 means that even if a message fails authentication, the receiving server will never block or quarantine it. The policy remains “in effect,” but no action is taken.

Attackers or compromised accounts can send emails from your domain without triggering any policy enforcement. Receiving servers have no way to detect that your domain is being abused—because DMARC says “don’t act on these failures” by design. This lack of enforcement removes any incentive for receiving systems to penalize senders who forge your domain.

What real-world damage looks like

Even with pct=0, attackers can still abuse your domain for phishing, spam, or brand impersonation. If an email from your domain lands in inboxes, no DMARC failure report is generated. That means you won’t see alerts about abuse, and your reputation may degrade without warning.

According to the DMARC standard (RFC 7483), the pct tag represents a percentage of messages that are subject to the policy enforcement. When set to 0, the policy is never applied. There’s no grace period, no learning mode—just no enforcement. That’s why industry best practices recommend starting with a monitoring policy (p=none) and gradually increasing pct as you observe legitimate traffic behavior.

If you’re unsure about your DMARC rollout, use tools like MailTester's inbox placement tests to see how your emails behave across real inboxes. You can also verify your sending list with bulk verification or check individual addresses via the real-time API to catch invalid or risky addresses before they hit your DMARC logs.

How should you properly implement DMARC sampling during rollout?

You should start with p=none and pct=0 to observe your email ecosystem without blocking anything. Gradually increase the pct value to 50, then 90, while reviewing DMARC reports to catch misconfigurations. Only move to p=quarantine or p=reject once you’ve confirmed all legitimate senders are aligned. Never leave pct=0 as a permanent setting—your domain remains vulnerable to spoofing and abuse.

Set up your DMARC rollout in phases

  1. Begin with p=none and pct=0. This configuration logs all traffic but never takes action. It’s your safest way to map out which senders—internal, third-party, or automated—are actually sending on your domain’s behalf. Use this phase to gather data on alignment issues, especially with email providers that require SPF or DKIM validation.
  2. After 7–14 days, analyze your DMARC reports using a tool like dmarcian.com or Spamhaus’ reporting services. Identify all valid senders and pinpoint which ones are failing alignment, especially those using marketing platforms or ESPs without proper DKIM signing.
  3. Now increase pct to 50. This means half of non-aligned messages will now be quarantined (e.g., sent to spam). Monitor your delivery volume and bounce rates closely. If you see drops in delivery—particularly from known partners—validate they’ve properly configured their outbound email headers.
  4. Move to pct=90 only after confirming 90% of your valid senders are properly aligned. Use tools like MailTester’s bulk list verification to test your email lists and ensure sender identities are consistent. This helps uncover invalid or risky senders before they trigger DMARC failures.
  5. Once confident, change p to quarantine, then move to reject only after thorough monitoring. The p=reject policy blocks non-aligned messages entirely, but only if you’re certain no legitimate traffic is at risk.

Why the pct=0 trick isn’t sustainable

“DMARC with pct=0 is like leaving your front door open while watching for burglars.” — industry practice in email security

Using pct=0 permanently gives you no protection. Abusers can still send emails that appear to come from your domain. Even with logging, you’re not stopping fraud or impersonation. Every day you delay enforcement increases the attack surface. Think of pct=0 as a diagnostic tool, not a policy. It should be used only during the initial discovery phase.

For ongoing email hygiene, especially when managing sender reputations or verifying high-volume lists, integrate inbox placement testing via MailTester’s inbox tester. It mimics real-world delivery and helps you validate what your DMARC policy is actually doing on major platforms.

DMARC verification: does your domain enforce policy as expected?

You can’t trust your DMARC policy unless you verify it’s actually enforced. MailTester’s real-time API checks your domain’s DMARC record live, showing whether p=reject will ever apply—or if pct=0 means no enforcement happens at all. It flags hidden risks like pct=0 with strict policies, which effectively disable your protection.

Use MailTester to catch flawed DMARC configurations

  • Check your domain's DMARC record in real time using MailTester’s verification API — no manual DNS lookup needed.
  • The API returns a verdict: valid, invalid, catch-all, or risky, with full details on policy enforcement status.
  • Look for pct=0 combined with p=reject — this is the pct=0 trick, designed to block mail but never enforce it. MailTester flags this as risky.
  • Understand how DMARC sampling works: pct=100 applies policy to all messages, but pct=0 means no messages are subject to enforcement, even if policy says reject.
  • Use the API to audit domains before launching sends, especially when using tools like SendGrid or Mailchimp.

Integrate verification into your workflow

  • Plug MailTester’s API into your onboarding or campaign setup to auto-verify sender domains.
  • Prevent campaigns from launching with weak or non-enforcing DMARC policies.
  • See real-time results including whether SPF and DKIM align, and if the record is validly published.
  • Use the real-time verification API to check individual addresses or domains, then audit your entire list with bulk verification.
  • Test inbox placement across major providers to confirm your messages are not blocked due to DMARC misconfiguration.

DMARC’s value lies not in its presence, but in enforcement. A record with pct=0 and p=reject is a silent vulnerability. MailTester exposes it before it causes a deliverability crisis. RFC 7483 details how DMARC policies are applied — ensure your implementation matches intent. Learn more in the official specification.

Even a well-intentioned DMARC policy can fail if it’s never enforced. Verify that your policy applies.

With MailTester, you don’t just check a record — you test whether it actually protects your domain. Integrate it early, verify before you send, and avoid campaigns that look valid but are quietly ignored by receivers. Check your setup at our integrations page or review pricing at our pricing page.

You can detect DMARC-related risks in bulk email lists by checking each address’s sender domain for DMARC records, especially those with pct=0 and p=reject. MailTester automatically analyzes these records during verification and flags domains where enforcement is disabled, revealing high-risk addresses. This helps you avoid sending to domains vulnerable to spoofing or misalignment.

How DMARC Sampling Works and Why pct=0 Matters

DMARC’s pct tag defines the percentage of emails subject to enforcement. When pct=0, even with p=reject set, no messages are actually blocked. This means any email sent from that domain—even if forged—might still reach the inbox. This is a common misconfiguration: the domain owner thinks they’re enforcing policy, but they’re not. MailTester detects this by parsing the full DMARC record and flagging such configurations as high risk.

As defined in RFC 7483, DMARC allows for sampling, but it’s only useful when pct is set to 100 and enforcement is active. A pct=0 setting with p=reject creates a false sense of security. The domain appears to be protected, but it isn’t. MailTester flags these instances because they signal poor email hygiene, regardless of whether the address itself is valid.

How MailTester Breaks Down Risks in Bulk Verification

During bulk list verification, MailTester doesn’t just check if an address exists—it evaluates the domain’s sender reputation, alignment, and DMARC policy. For example, an address may pass syntax checks but still be tied to a domain with a pct=0 record, which undermines message authenticity.

The verification process separates risks into categories: domain validity (does the domain exist?), sender reputation (is the domain blacklisted?), and alignment (does the From domain match the SPF/DKIM results?). DMARC issues like pct=0 fall under alignment and enforcement status, helping you understand how likely your email is to be marked as suspicious or fail authentication.

With this insight, you can prioritize cleaning your list. Use MailTester’s bulk verification to find and remove addresses from domains with weak DMARC settings. This reduces the risk of your emails being blocked, marked as spam, or rejected by modern filtering systems. The tool works across thousands of addresses—perfect for campaigns where inbox placement is critical.

What does a 'pct=0' DMARC record actually mean in real-world deliverability?

A pct=0 DMARC record means the domain’s policy is never enforced, even if emails fail SPF or DKIM alignment. Receiving servers ignore the policy and deliver messages as if no DMARC policy exists. This creates a blind spot that attackers actively exploit by spoofing domains with p=reject but pct=0 to bypass filtering.

Why pct=0 doesn’t protect your domain

Even if you set p=reject in your DMARC record, setting pct=0 means no enforcement happens. The domain is treated as having no policy at all. This is not a test run — it’s a full disable. You’re signaling, “I don’t care if my emails are forged.”

According to the official DMARC specification (RFC 7483), a pct=0 record means no portion of email from that domain is subject to the policy. Receiving servers don’t even check alignment in this case. If the policy is p=reject but pct=0, the domain is essentially open to abuse.

How attackers use the pct=0 trick

Attackers craft DMARC records with p=reject and pct=0 to look legitimate while evading DMARC enforcement. The p=reject value implies strict alignment, but pct=0 nullifies it. This is a known loophole: some attackers use it to make their spoofed domains appear compliant while sending spam.

Spam filters don’t ignore this behavior entirely. If a domain with pct=0 and p=reject begins sending mass spam, its reputation will suffer quickly. Once abuse is detected, email providers may block or flag the domain. The policy’s intent is clear, but implementation fails.

Let’s be clear: pct=0 is not a testing feature. It’s a configuration error by default. If you don’t want DMARC to enforce anything, don’t deploy it. If you do, set pct=100 from day one.

Check if your domain is vulnerable. Use a real-time verification API to scan your sender list for risky configurations like pct=0, invalid SPF, or missing DKIM. MailTester’s email verification API checks headers and DMARC records in bulk, helping you catch risky domains before they harm deliverability.

DMARC logging and the false sense of security from pct=0

Setting pct=0 in your DMARC record means you’re not enforcing any policy on receiving servers — so no emails get rejected. But you still get failure reports, and those logs don’t trigger corrective actions. That creates a false sense of security: you see data, but misconfigurations, bad actors, or phishing attempts go unaddressed, quietly eroding your sender reputation over time.

Why pct=0 doesn’t stop abuse

When pct=0, receiving servers still send DMARC failure reports to your email address, even if they don’t block the message. These reports show you what’s being rejected — but since nothing is actually blocked, you’re not forced to fix the underlying issues.

Let’s say an unauthorized sender uses your domain to send spam. With pct=0, the emails pass through. The receiving server logs the failure — but you don’t act. No enforcement means no urgency, and no action means the abuse continues.

Long-term consequences of inaction

Spam traps, compromised accounts, and phishing campaigns using your domain can accumulate without detection. Each one harms your sender reputation, especially if repeated. According to the Anti-Phishing Working Group, domains with poor DMARC enforcement are more likely to be exploited — and more likely to end up on blocklists.

These failures build up behind the scenes. You see the logs, but because there’s no enforcement, they don’t drive changes. Eventually, even legitimate emails struggle to reach inboxes, especially with modern filtering systems that detect patterns of abuse.

DMARC logging without enforcement gives you visibility, but not control. You’re collecting data without accountability. For long-term deliverability, logging alone isn’t enough — you need to act on the data.

That’s where tools like MailTester help. While not a DMARC tool, it verifies email lists and identifies risky or invalid addresses before they harm your sending reputation. A clean list reduces the chance of spoofing, supports better inbox placement, and aligns with strong authentication practices.

DMARC reports are useful — but only if you use them to fix problems, not just monitor them.

A practical checklist for DMARC configuration best practices

Start with p=none and pct=100 to gather data without blocking mail. Gradually increase pct to 90 to test enforcement on most messages, not all at once. Never use pct=0 with p=reject—it’s a configuration dead end. Monitor aggregate reports (RUF) weekly. Validate domains using tools like MailTester before sending at scale. Ensure SPF, DKIM, and DMARC work together to verify sender identity. This layered approach prevents delivery failures and builds sender reputation safely.

Step-by-step DMARC rollout

  • Begin with p=none and pct=100 to collect full visibility into email sources—this is the only way to see all messages sent on your domain’s behalf.
  • After 3–4 weeks of data collection, start enforcing policy with p=quarantine or p=reject at pct=90. This limits risk while gradually reducing spoofing.
  • Avoid pct=0 with p=reject. It blocks nothing while claiming to enforce policy—this is a common mistake that creates false confidence.
  • Set up RUF (forensic) and RPT (aggregate) reporting to a monitoring mailbox. Review these reports weekly to catch unauthorized senders or misconfigurations.
  • Use MailTester’s bulk verification tool to clean your lists before sending at scale: https://mailtester.com/email-list-verify.

Ensure sender identity is properly validated

  • Align SPF (sender policy framework) with the actual sending IPs. Avoid overly broad mechanisms.
  • Use DKIM with consistent signing across all sending platforms to prove message integrity.
  • Verify that SPF, DKIM, and DMARC are all aligned—especially for third-party tools like email service providers.
  • Test deliverability before launch using an inbox placement tool: https://mailtester.com/inbox-tester.
  • Regularly audit your configuration. Small errors in include or all mechanisms can break delivery.
DMARC won't fix poor deliverability—but it’s essential for stopping spoofed emails and protecting your domain's reputation.

Drafting DMARC policies without real data is like flying blind. Let the reports guide you, not assumptions. Use the verification API for real-time checks: https://mailtester.com/api-email-checker.

Integrations with platforms like Mailchimp, Klaviyo, and SendGrid help synchronize configuration across tools—check your setup with MailTester’s integration support: https://mailtester.com/integrations.

DMARC’s pct tag is not a toggle—it’s a sampling mechanism. When set to 90, it applies the policy to 90% of messages based on a rolling, randomized selection per message source. The rest are treated as none. This is not a backdoor—it’s intentional for reducing disruption during policy rollout.

For deeper insight into email authentication standards, see the RFC 7483 specification on DMARC at https://tools.ietf.org/html/rfc7483.

In the end, DMARC isn’t just about policy — it’s about trust

Setting p=reject with pct=0 creates a compliance gap. The domain appears secure, but no enforcement occurs — leaving email streams exposed to forgery and abuse.

Trust in email delivery depends on consistent, predictable behavior. When policies like DMARC are applied inconsistently, ISPs and receivers lose confidence, even if the misconfiguration is small.

Even a single misconfigured pct tag can quietly erode sender reputation over time. It’s not about immediate failure—it’s about gradual distrust building across systems that monitor sender behavior.

MailTester’s 98.9% accurate verification helps catch such risks before they impact your inbox placement. It’s not just about checking syntax—it’s about ensuring every setting truly protects your domain.

Sources

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

Does pct=0 mean DMARC is fully disabled?

No — DMARC is not disabled, but enforcement behavior is inactive. The domain still receives reports, but no emails are rejected or quarantined based on policy.

Can pct=0 cause emails to be rejected?

No — emails are never rejected when pct=0, even if they fail SPF or DKIM alignment. The policy is never applied.

Why would a domain set pct=0 with p=reject?

It may be a misconfiguration. Some administrators use it as a placeholder, but it provides no real security.

What happens if a domain has pct=0 and a spoofed email is sent?

The spoofed email will still be treated as aligned and delivered. No enforcement occurs, so the attacker gains visibility and trust.

How can I test if my domain’s DMARC is properly enforcing policy?

Use a tool like MailTester’s real-time verification API to check alignment, policy, and sampling status. It flags domains with pct=0 and p=reject as risky.

Is it safe to use pct=0 during DMARC rollout?

Only in the earliest phase, when the goal is logging only. Once rolling out enforcement, use percent values of 50, 90, or 100 to test safely.

What is the difference between DMARC policy and sampling?

Policy (p=none, p=quarantine, p=reject) defines action. Sampling (pct) defines what percentage of emails are subject to that action.

Does MailTester test DMARC policy enforcement behavior?

Yes — MailTester analyzes SPF, DKIM, and DMARC records, including pct tags, and flags domains with pct=0 and p=reject as high-risk.

Can a domain with pct=0 still get spam trap hits?

Yes — if the domain is abused, spam traps can be triggered. Since no enforcement occurs, the damage accumulates silently.

How accurate is MailTester’s DMARC verification?

MailTester maintains 98.9% accuracy in verifying email addresses and their domain configurations, including DMARC settings.

Can I verify a list for DMARC risks before sending?

Yes — MailTester’s bulk verification service checks email addresses and domains for DMARC-related risks like pct=0 policy misuse.

Why should I care about DMARC sampling even if I don’t send emails?

Even if you don’t send, your domain may be spoofed. A pct=0 record allows abuse to go unchecked, harming your reputation.