Do DMARC and BIMI require p=reject to be present on the organizational domain?

While DMARC and BIMI technically support both `p=quarantine` and `p=reject` policies at the organizational domain, there's a strong consensus that `p=reject` offers superior protection against spoofing and phishing, ultimately enhancing brand security and deliverability. For BIMI compliance, a DMARC policy is mandatory, alongside SPF and DKIM. However, small senders and those with complex email setups should exercise caution with `p=reject`, as misconfigurations can lead to legitimate emails being blocked. Alternatives like `p=none` or `p=quarantine` may be more suitable in such cases, emphasizing the importance of aligning the DMARC policy with the organization's risk tolerance and monitoring capabilities. A strict policy at the organizational domain is crucial, particularly when using subdomains.

While a DMARC policy with `p=reject` is not strictly mandatory for BIMI, it is highly recommended and considered best practice for optimal effectiveness and brand protection. BIMI can function with a `p=quarantine` policy, but `p=reject` offers the strongest security posture and increases the likelihood of BIMI compliance and logo display. The choice between `p=quarantine` and `p=reject` often depends on the organization's risk tolerance, monitoring capabilities, and specific needs.

While opinions vary, DMARC policy implementation, specifically the `p=reject` option, is not a straightforward decision. Having a DMARC policy at the organizational domain level is crucial, especially if subdomains are used. Although BIMI might function with `p=quarantine`, the `p=reject` policy bolsters domain protection and indirectly enhances deliverability by mitigating spoofing risks. However, small senders should approach `p=reject` cautiously due to the potential for legitimate emails being blocked if authentication is misconfigured. Alternative policies like `p=none` or `p=quarantine` might be more appropriate for low-volume senders.

BIMI requires a DMARC policy set to either `p=quarantine` or `p=reject`, along with SPF and DKIM authentication. While both policies technically satisfy BIMI's requirements, `p=reject` offers stronger protection against spoofing and phishing. The `quarantine` tag advises mail systems to treat failing messages as suspicious (e.g., placing them in spam), while `reject` instructs mail systems to reject the message outright, though they may sometimes silently drop it.