DMARC Policies
DMARC supports three enforcement policy levels, each representing a different degree of protection:
- p=none(Monitor Mode) – No enforcement. Messages that fail DMARC are still delivered, but the domain owner receives DMARC reports to observe unauthorized activity.
- p=quarantine(Partial Enforcement) – Suspicious messages are marked as spam or placed in the recipient’s junk folder. This helps reduce risk while still allowing legitimate but misconfigured mail to surface.
- p=reject(Full Enforcement) – Messages that fail DMARC are completely rejected at the server level and never reach the recipient. This is the strongest protection against spoofing.
Domains typically begin with p=none, then progress to quarantine and finally to reject once all legitimate senders are properly authenticated.