What the policy means
- p=none
- Changes nothing for the recipient. The domain owner only collects reports. This is where you start.
- p=quarantine
- A message that fails is filed as spam by the receiver.
- p=reject
- A message that fails is rejected. This is the state to work towards.
DMARC passes when a message passes SPF or DKIM and the domain of that check lines up with the domain in the From address the recipient sees. A valid SPF or DKIM result on its own is not enough: without that alignment the message still fails DMARC.
The other tags and the reports
- sp
- The policy for subdomains. When sp is present a subdomain follows it, when it is absent a subdomain follows p.
- adkim, aspf
- How strictly the domains have to line up. r, the default, accepts a subdomain of the organisational domain, s demands an exact match.
- pct
- The share of messages the policy is applied to. It exists for a gradual rollout, and the end state is 100.
- rua
- Where aggregate reports go. They are XML summaries, usually one per day per receiver, listing which servers sent mail as your domain.
- ruf
- Where failure reports go. They carry parts of individual messages, and many receivers do not send them at all for privacy reasons.
Without aggregate reports there is no safe way to reach reject, because they are the only place where you find out which of your own systems still fail. If the report address is on another domain, that domain has to publish a record authorising it, and the tool shows what that record should look like.