The DMARC p tag sets the policy for mail that fails. p=none monitors only (no protection). p=quarantine sends failing mail to spam. p=reject blocks it outright. You start at none to gather data, then move to quarantine and finally reject, which is the goal for every domain.
Nothing is blocked; you simply receive reports. It is the essential first step to discover every sender, but a domain on p=none is not protected from spoofing. Treat it as temporary.
Failing mail is delivered to the junk/spam folder. Real protection begins here. Many teams pause at quarantine (optionally with pct) before full rejection.
Failing mail is rejected and never reaches the inbox — the strongest protection and the end state the Google/Yahoo rules expect for bulk senders. Only move here once reports show every legitimate sender passing and aligning.
Check your DMARC record now
Open the free DMARC checker →Most organizations need a few weeks of monitoring to find and authenticate every sender. Skysnag automates source discovery so many domains reach reject in about 30 days without blocking real mail.
It protects you, but reject is stronger and is what bulk-sender requirements expect. Quarantine is a fine intermediate step, not the ideal destination.
