p=reject tells every receiving mail server: do not deliver anything from my domain unless it passes DMARC. It’s the strongest stance email authentication offers—highly effective against phishing that spoofs your domain, and equally effective against your own misconfigured senders.
When the answer is yes
- You send bulk mail to consumers. Enforcement is increasingly the expectation, not the extra credit.
- Your domain is a phishing target. Fintech, healthcare, anything with logins and money—reject is the point of the whole exercise.
- You want BIMI. Logo-in-inbox standards require an enforcing policy (
quarantineorreject) before they’ll even look at you. - Your reports are clean. Every legitimate source authenticates and aligns, and has for a while.
When the answer is not yet
If you haven’t spent time in your DMARC reports (rua), you don’t actually know who sends as your domain. The billing platform, the CRM, the support desk, the survey tool marketing signed up for—any of them not passing and aligning gets bounced the moment you publish reject. With rejection, failures are loud: mail bounces, people complain, broken flows surface fast. That’s a feature when you’re ready and an outage when you’re not.
The rollout that works
p=nonewith reporting—gather data, no enforcement.- Fix what you find—authenticate every legitimate source, align domains.
p=quarantine—failing mail goes to spam rather than bouncing. Beware the quiet failure mode: broken-but-legitimate senders can sit in spam-folder purgatory unnoticed.p=reject—once reports stay clean.
Two footnotes from the trenches: the pct= parameter for gradual rollout is not widely respected by mailbox providers, so don’t lean on it—and enforcement on the root domain applies to subdomains unless you say otherwise with sp=. DMARC was designed for gradual rollout; use the reports and the climb is painless.