DMARC policy

The three settings

The p= tag tells receivers what to do with mail that fails DMARC:

• `p=none` — do nothing; just report. The right starting point. Mail is delivered as before, and you get reports.
• `p=quarantine` — treat failing mail as suspicious, usually the spam folder.
• `p=reject` — refuse failing mail during the SMTP conversation. It is never delivered; the sender's server is told it was rejected.

A failing message is one where neither SPF nor DKIM passed and aligned with the From domain. See DMARC.

Moving up safely

The policy is a statement of confidence that every legitimate source of your mail is authenticated. Raise it only once that is true:

1. Stay at none until the aggregate reports show only sources you recognise, all passing.
2. Fix the stragglers: a forgotten billing tool, an old marketing platform.
3. Move to quarantine. Watch for complaints that mail is missing.
4. Move to reject when quarantine has run clean.

Skipping to reject is the standard way to lose real mail.

Subdomains and the sp tag

By default, a policy applies to subdomains too. The sp= tag sets a different one, which is useful when your main domain is at reject but a sending subdomain is still being brought into line.

What it does for cold email

Some mailbox providers reward an enforced policy, and enforcement is a prerequisite for showing a logo with BIMI. For outbound alone, a correct none with aligned SPF or DKIM is fine. Build a record with the DMARC generator.