Skip to content
Clinic open · free diagnosis, no appointment needed2,000+ domains monitored

p=reject

The DMARC policy instructing receivers to refuse messages that fail authentication for the From domain, rather than delivering or quarantining them. Defined in RFC 9989 section 4.7.

Sumit Raj · reviewed

The DMARC policy that actually stops impersonation. Mail failing authentication for your domain is refused during the SMTP conversation: it does not arrive anywhere, and the sender receives a bounce.

This is the goal state, and it is what the bulk sender requirements are steering everybody towards.

Two things to check before publishing it. Every legitimate sender must be authorised, which you establish by reading aggregate reports at p=none for a full billing cycle rather than by memory. And sp should be set explicitly, because a weaker subdomain policy means an attacker spoofs invoices.yourcompany.com instead, which looks just as convincing in an inbox.

Mistakes at reject are not recoverable. A refused message is gone, and whoever sent it gets a technical bounce they will not understand. That is the argument for spending time at quarantine first, where a mistake lands somewhere retrievable.

p=reject; t=y protects nothing: the t tag makes receivers apply p=none regardless. It is the most common reason a domain owner is certain they are protected when they are not.

Related

  • DMARCDomain-based Message Authentication, Reporting and Conformance: a DNS record that requires SPF or DKIM to pass for the visible From domain, and instructs receivers what to do when neither does. Defined in RFC 9989.
  • DMARC alignmentThe DMARC requirement that the domain authenticated by SPF or DKIM matches the domain in the visible From header, either exactly (strict) or allowing subdomains (relaxed). Defined in RFC 9989 section 4.4.
  • SPFSender Policy Framework: a DNS TXT record listing the servers authorised to send mail using a domain in the SMTP envelope sender. Defined in RFC 7208.
  • DKIMDomainKeys Identified Mail: a cryptographic signature added to outgoing messages and verified against a public key published in the sending domain's DNS. Defined in RFC 6376.
  • p=none, quarantine or reject?Three policies, one of which protects nothing. What each does to your mail and how to move between them without breaking anything.
  • How to set up DMARCFrom no record to enforcement, in five steps. The first takes ten minutes; the rest are mostly waiting and reading.
  • DMARC TestTree-walk discovery, inheritance, test mode and the policy receivers really apply.
  • SpoofabilityCan somebody send as you right now? One verdict, no hedging.

Every fix on this site is yours to implement. If you would rather someone did it, I take this work directly.