p=none

Requests monitoring with no DMARC-requested delivery action for failures. Use it to establish reporting coverage and find legitimate authentication gaps.

v=DMARC1; p=none; rua=mailto:reports@example.com

p=quarantine

Requests that failing mail be treated as suspicious, commonly resulting in spam-folder placement or additional scrutiny. Receiver behaviour remains subject to local policy.

v=DMARC1; p=quarantine; rua=mailto:reports@example.com

p=reject

Requests rejection of mail that fails DMARC. It gives the clearest anti-spoofing instruction but can expose overlooked legitimate senders immediately.

v=DMARC1; p=reject; rua=mailto:reports@example.com

A practical rollout

  • Inventory every expected sender and subdomain.
  • Fix alignment for legitimate sources.
  • Observe complete business cycles, including infrequent systems.
  • Move policy in controlled steps and monitor the results.
  • Keep rollback ownership and DNS access clear.
Further readingDMARC — RFC 9989Google's recommended DMARC rollout