What is a DMARC policy? (p=none, quarantine, reject)

Definition

The DMARC policy is the value of the p= tag in your DMARC record. It applies to messages that use your domain in the From line and fail DMARC (no aligned SPF or DKIM pass). There are exactly three levels:

• p=none (monitoring): deliver normally, but send me reports. Zero risk to your mail, zero protection against spoofing. This is the correct starting point, not a destination.
• p=quarantine: treat failing mail as suspicious. In practice that means the spam folder for most consumer receivers, an admin-visible quarantine for some business suites.
• p=reject: refuse failing mail outright during delivery. The sender gets a bounce; your reader never sees the message. This is full enforcement, and the level the 2024 bulk-sender rules pushed the industry toward.

What a policy does not do

A policy is a request, not physics: receivers may apply local overrides (a mailing-list exception, a trusted-forwarder rule), and aggregate reports disclose when they do. It also only covers mail that fails DMARC: a phisher using their own domain with a lookalike display name passes cleanly, because DMARC protects the address, not the human impression.

Choosing a level

The safe path is staged: publish p=none with a rua= address, use the reports to find every legitimate service sending as you, fix their authentication until aligned pass rates are healthy, then move to quarantine and on to reject. The risk of skipping steps is real mail silently spam-foldered; the risk of never finishing is a domain that reports spoofing daily and blocks none of it. Subdomains follow p= unless sp= says otherwise, so check both before declaring victory.