The p= tag in your DMARC record is the only part that tells receivers what to do with mail that fails authentication. Everything else in the record (reporting addresses, subdomain policy, percentage) is supporting detail. Three values exist, and most domains use the wrong one for their stage.
p=none means "deliver the mail anyway, but send me aggregate reports about it." It changes nothing about how your mail is treated. Its value is entirely diagnostic: the reports (delivered to your rua= address) list every sender that used your domain, whether each one authenticated, and from which IP. If you have no idea who sends mail as your domain, p=none is the only honest way to find out. It is also the minimum that Gmail and Yahoo's bulk-sender requirements ask for.
p=quarantine asks receivers to route failing mail to the spam folder instead of the inbox. "Asks" is the right word: it is a request, and each provider implements it differently. In practice, at major providers, it moves failing mail out of the inbox. Use it when your reports show only your own legitimate senders passing, and you want spoofed mail to stop reaching inboxes but you are not ready to refuse delivery outright.
p=reject tells receivers to refuse delivery of failing mail. This is the end state for a domain that is fully managed: every legitimate sender authenticates, so anything that fails is by definition unauthorized. Large senders (Google, Microsoft, Apple) run p=reject on their domains. For a small business, p=reject is reachable, but only after the two prerequisites: SPF and DKIM that actually cover every system that sends for you, and a period of clean reports proving nothing legitimate would break.
1. Start at p=none with a rua= address you check. Do not skip this step to "look serious." You cannot safely enforce a policy you have not observed.
2. Fix everything the reports reveal. Unknown senders, missing DKIM, SPF with too many lookups. This is usually the bulk of the work.
3. Move to p=quarantine when reports show only expected, authenticating senders for a few weeks.
4. Move to p=reject after another clean period. Use pct= (for example pct=10) if you want to enforce on a slice of traffic first and ramp up.
sp= sets the policy for subdomains separately from the apex. If you run marketing on mail.yourdomain.com but the apex has no real mail, an sp=reject with p=none lets you enforce on the subdomain while the apex stays in monitoring. And pct= applies the policy to a percentage of failing mail, which is how you test enforcement without a hard cutover.
Domains that jump straight to p=reject without reading reports end up rejecting their own transactional mail: a forgotten ESP, a legacy invoice system, a subdomain that sends with its own SPF. The symptom is "our customers say they never get our emails," and the cause is a policy stricter than the sending setup underneath it. The record is cheap to fix; the week of lost invoices is not.
Related: What is DMARC? · SPF vs DKIM vs DMARC · Why email misses Gmail's inbox · How to monitor DMARC reports
The free DMARC checker shows your current record, policy and whether SPF/DKIM are aligned, in seconds. No signup.
Check my DMARC recordWant this checked automatically every day? Inboxproof Pro monitors your domain around the clock and alerts you the moment a record breaks or an IP gets listed. See pricing →