The policy is the part of DMARC that does something. Everything else is checking and reporting.
The three values
| Policy | Receiver does | Use it when |
|---|---|---|
p=none |
Delivers the mail as normal, and sends you reports | You are starting out and still finding your senders |
p=quarantine |
Treats failing mail as suspicious, usually the spam folder | Reports show your real senders pass |
p=reject |
Refuses failing mail outright | Everything legitimate passes and you want to stop spoofing |
Related tags
sp=sets a different policy for subdomains.pct=applies the policy to a percentage of failing mail, so you can roll out in steps.rua=andruf=name where aggregate and forensic reports go.
Moving to enforcement
Going straight to reject is the classic way to block your own mail. A safer path:
- Publish
p=noneand a report address. - Let reports collect for a few weeks, long enough to see the monthly senders.
- Fix every legitimate source that fails, usually a forgotten tool sending on your behalf.
- Move to
p=quarantine, perhaps withpctstarting low. - Move to
p=rejectonce the reports stay clean.
Policy and Amazon SES
Mail you send through SES passes when DKIM is signed with your own domain or SPF is aligned through a custom MAIL FROM domain. Before enforcing, confirm both in your authentication setup, since SES mail is probably only one of several senders on your domain.
Common questions
Which DMARC policy should I use?
Start with none, read the reports, fix what fails, then move to quarantine and finally reject. The destination is reject, but only once every legitimate sender is aligned.
What does pct do?
The pct tag applies the policy to only a share of failing mail, for example pct=25. It lets you roll out quarantine or reject gradually.