What DMARC settings should I use and what are the implications of using p=reject?
Michael Ko
Co-founder & CEO, Suped
Published 12 Jun 2025
Updated 17 Aug 2025
6 min read
When considering your DMARC settings, especially the p=reject policy, it's natural to have questions. This is particularly true given the recent industry shifts where major mailbox providers like Google and Yahoo are emphasizing strong authentication.
The goal of DMARC is to protect your domain from impersonation and phishing attacks by giving receiving email servers instructions on what to do with messages that fail authentication checks. While moving to p=reject is often the ultimate aim for maximum protection, it comes with significant implications that require careful consideration and planning.
My aim here is to help you navigate the various DMARC settings, especially when and how to confidently move towards a reject policy, without inadvertently blocking your legitimate emails.
DMARC (Domain-based Message Authentication, Reporting, and Conformance) relies on SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) to verify email authenticity. It provides three main policy options, each with a different level of enforcement against emails that fail authentication and alignment checks. Understanding these policies is crucial before making any changes.
The p=none policy is a monitoring mode, meaning no action is taken against unauthenticated emails, but you receive DMARC aggregate reports. This is generally the starting point for DMARC implementation, allowing you to gather data and identify all legitimate sending sources.
Moving up, p=quarantine tells receiving servers to place emails that fail DMARC checks into the recipient's spam or junk folder. This acts as a soft enforcement, allowing you to see the impact of authentication failures without outright blocking emails. For a deeper dive into when to use each policy, you can refer to our guide on DMARC policies.
Policy
Action on Failure
Primary Use Case
p=none
No action, emails delivered normally.
Monitoring and data gathering.
p=quarantine
Emails sent to spam/junk folder.
Soft enforcement, testing for false positives.
p=reject
Emails completely blocked/rejected.
Full enforcement, maximum protection against spoofing.
The power of p=reject
The p=reject policy is the strongest DMARC enforcement level. When you set your DMARC record to p=reject, you instruct receiving mail servers to outright block any emails that claim to be from your domain but fail DMARC authentication checks. This means such emails will never reach the recipient's inbox or spam folder.
The primary benefit of p=reject is its robust protection against email spoofing and phishing attacks. By preventing unauthorized emails from reaching their destination, you significantly reduce the risk of your domain being used for malicious purposes, safeguarding your brand's reputation and your recipients' trust. This direct action against fraudulent emails is a core reason why organizations aim for this policy.
Implementing a reject policy also signals to mailbox providers that you are serious about email security, which can positively influence your overall domain reputation. It helps maintain the integrity of your email communications, ensuring that recipients only receive legitimate messages from your domain. For more on combating spoofing, explore how to use DMARC p=reject.
Why choose p=reject?
Maximum Security: Directly prevents phishing and spoofing by blocking unauthorized emails.
Brand Protection: Safeguards your brand's integrity and customer trust.
Improved Trust: Signals to mailbox providers that your domain is secure, potentially boosting deliverability.
Navigating the implications of p=reject
While p=reject offers the highest level of protection, its implementation carries significant implications. The most critical risk is the potential for legitimate emails to be mistakenly blocked if they fail DMARC authentication and alignment checks. This can happen if your SPF or DKIM records are not properly configured for all your sending sources. An email that fails these checks will not reach the recipient, leading to missed communications and potential business disruptions.
Before moving to p=reject, it's imperative to ensure all your legitimate email senders are correctly authenticated. This includes your transactional emails, marketing platforms, and third-party services. Microsoft's documentation on email authentication DMARC highlights the importance of thorough configuration. Without careful planning, you might inadvertently disrupt your email flow. Learn how to implement DMARC safely to avoid deliverability issues.
Another implication is the need for continuous monitoring. Even after successful implementation, changes to your email infrastructure or third-party senders can cause authentication failures. DMARC aggregate reports (RUA) are critical for ongoing visibility into your email ecosystem, helping you detect and resolve issues quickly. Without these reports, you would be unaware of legitimate emails being blocked.
Direct switch to p=reject
Risk of legitimate email loss: Any misconfigured sending source will immediately have its emails blocked.
Damage to sender reputation: Sudden increase in blocked emails can harm your domain's standing.
Lack of visibility: Without prior monitoring, you won't know which sources are failing.
Phased rollout with monitoring
Minimizes disruption: Start with p=none, then p=quarantine, analyzing reports at each stage.
Identifies legitimate sources: Pinpoint and configure all valid senders before enforcement.
Ensures deliverability: Gradually increase protection as you gain confidence in your DMARC compliance.
Implementing and monitoring p=reject
The key to successfully implementing p=reject is a phased approach. Start with a p=none policy and configure rua and ruf tags to receive aggregate and forensic reports. These reports provide invaluable insight into your email sending patterns and DMARC compliance. Analyzing them allows you to identify any legitimate email sources that are not yet authenticated or are failing DMARC.
Once you're confident that all your legitimate emails are passing DMARC authentication, you can gradually move to p=quarantine, monitoring reports for any unexpected quarantining. If everything looks good, you can then proceed to p=reject. Utilizing the pct tag, which allows you to apply the policy to a percentage of your emails, can further mitigate risk during this transition. The DMARC FAQ on dmarc.org provides additional technical details.
Regular DMARC monitoring is not a one-time setup, especially with p=reject. It's an ongoing process to ensure sustained email deliverability and security. You should regularly review your DMARC reports for new or unexpected sending sources, authentication failures, or changes in traffic patterns. This proactive approach helps in quickly troubleshooting any issues that arise. For more on this, check out our guide on troubleshooting DMARC reject policies.
Example DMARC record with p=reject and RUA reports
Using a DMARC management platform simplifies report analysis and policy transitions.
A DMARC policy of p=reject should be the long-term goal for maximum protection.
Even if your domain doesn't send emails, implement p=reject to prevent spoofing.
Ensure DMARC alignment (relaxed or strict) is considered for both SPF and DKIM.
When moving to p=reject, be aware that some providers might downgrade it to quarantine.
Marketer view
Marketer from Email Geeks says they were confused by new guidelines, thinking they needed to roll back their DMARC p=reject to p=none, but their ESP confirmed that p=reject is a stronger policy and not a rollback is needed.
February 1, 2024 - Email Geeks
Expert view
Expert from Email Geeks says that if a domain is already enforcing a reject policy, there is no need to roll it back.
February 1, 2024 - Email Geeks
Achieving DMARC enforcement with confidence
Choosing the right DMARC settings and implementing p=reject is a critical step towards securing your email ecosystem and ensuring optimal deliverability. While p=reject offers the highest level of protection against spoofing and phishing, it demands a strategic, phased approach, thorough configuration of SPF and DKIM, and continuous monitoring of DMARC reports. By following these best practices, you can confidently transition to a reject policy, safeguard your brand, and maintain trust with your recipients, without compromising the delivery of your legitimate emails.
