Move to p=reject only when your DMARC reports show every legitimate sender passing and aligning for a sustained period. Optionally use pct or a subdomain-first rollout to ramp. The change itself is one edit: p=quarantine → p=reject.
Review a few weeks of aggregate reports. Every real sending service should show SPF or DKIM passing and aligned. If anything legitimate still fails, fix it before rejecting, or it will be blocked.
You can apply reject to subdomains first via sp=reject, or keep p=quarantine on the org domain a little longer. Once confident, set p=reject.
See where you stand:
$ dig TXT _dmarc.yourdomain.com +shortCheck your DMARC record now
Open the free DMARC checker →It protects you, but reject is stronger and is what bulk-sender rules expect. Quarantine still lets spoofed mail reach the spam folder, where some users find it.
