What is a DMARC policy? (p=none, quarantine, reject)

Definition

The DMARC policy is the value of the p= tag in your DMARC record. It applies to messages that use your domain in the From line and fail DMARC (no aligned SPF or DKIM pass). There are exactly three levels:

• p=none (monitoring): handle the message as you normally would, but send me reports. Nothing changes for your mail, and nothing changes for forged mail either. This is the correct starting point, not a destination.
• p=quarantine: treat failing mail as suspicious. In practice that means the spam folder for most consumer receivers, an admin-visible quarantine for some business suites.
• p=reject: refuse failing mail outright during delivery. The sender gets a bounce; your reader never sees the message. This is full enforcement, and the end of the staged path.

What a policy does not do

A policy is a request, not physics: receivers may apply local overrides (a mailing-list exception, a trusted-forwarder rule), and aggregate reports disclose when they do. It also only covers mail that fails DMARC: a phisher using their own domain with a lookalike display name passes cleanly, because DMARC covers the address, not the human impression.

Choosing a level

The safe path is staged: publish p=none with a rua= address, use the reports to find every legitimate service sending as you, fix their authentication until aligned pass rates are healthy, then move to quarantine and on to reject. The risk of skipping steps is real mail silently spam-foldered; the risk of never finishing is a domain that reports spoofing daily while receivers refuse none of it. Subdomains follow p= unless sp= says otherwise, so check both before declaring victory.