What is a DMARC policy?

Three values exist and they escalate: none, quarantine, reject. The pct tag applies a policy to a sampled percentage, which is how careful senders roll out enforcement gradually.

Start at none with a reporting address and read two weeks of aggregate reports. They will name every IP sending as you, including the tools nobody documented.

Move to quarantine at a low percentage, watch, then raise it. Spam-folder placement for a missed sender is recoverable; rejection is not, because the message is gone.

A separate sp tag governs subdomains. Without it they inherit your policy, which surprises people whose transactional mail runs from a subdomain that was never authenticated.

DMARC lives in a TXT record at _dmarc.yourdomain.com. Say yours reads v=DMARC1; p=quarantine; pct=25; sp=none; rua=mailto:dmarc@acme.example. A receiver that gets a failing message from your main domain samples it, and roughly one failing message in four is quarantined.

What happens to the other three surprises people. RFC 7489 says mail that falls outside the sampled percentage gets the next policy down, so here it's treated as none. With p=reject; pct=25, the unsampled 75% is quarantined instead of delivered normally. A partial reject is therefore stricter than it looks.

Subdomain lookups have an order as well. For mail from news.acme.example, the receiver first checks _dmarc.news.acme.example. Only if nothing is there does it fall back to the main record and use sp, or p when sp is absent.

Publishing two DMARC records is the quietest failure. It usually happens when a second vendor's setup wizard tells you to add a record and you already had one. Receivers that find two TXT records starting v=DMARC1 at that name discard both, and you're back to no policy at all.

Reports sent to another domain need permission from that domain. If your rua address is at reports.vendor.example, the vendor has to publish a TXT record at acme.example._report._dmarc.reports.vendor.example containing v=DMARC1. Without it, careful receivers won't send the reports, and you'll assume no news is good news.

Remember that the policy is a request. Receivers are allowed to apply local judgment, and the aggregate reports tell you when they did through an override reason such as forwarded or mailing_list. When the disposition in a report doesn't match your p value, read that field before you assume something is broken.