Three words in a DNS record are the difference between a scammer’s fake email bouncing straight back to them, or landing in your customer’s inbox looking exactly like it came from you.
If you’ve had a DMARC record explained to you before, you’ve probably heard the phrase “get to p=reject” without anyone quite explaining what it means, or why it matters more than almost anything else in your email setup. Here’s the plain-English version.
First, a quick recap: what DMARC actually does
DMARC (Domain-based Message Authentication, Reporting and Conformance) is the setting that ties your SPF and DKIM checks together and tells receiving mail servers what to do when an email fails them. Without it, SPF and DKIM can technically be in place on your domain and still do almost nothing to stop impersonation — because nothing is enforcing the result.
DMARC has a policy tag — written as “p=” in your DNS record — that has exactly three possible values. That single tag is the entire difference between a domain that’s genuinely protected and one that only looks protected on paper.
The three settings, in order
p=none — Monitoring only. This is the starting point for every domain. It tells receiving servers “don’t do anything different, just let me know what you see.” Nothing is blocked or filtered; you’re purely gathering visibility on who’s sending email using your domain, including anyone spoofing it. Most domains that have “started” DMARC are sitting here — which, on its own, blocks nothing.
p=quarantine — Suspicious mail gets sidelined. This tells receiving servers to route anything failing DMARC into the spam or junk folder instead of the inbox. It’s a genuine step up: fewer fake emails land where they’ll be trusted. But it isn’t full protection — some spam folders get checked, and some don’t.
p=reject — Full enforcement. This tells receiving servers to refuse the email outright. It never reaches an inbox, a spam folder, or anywhere else. As far as the recipient is concerned, it simply doesn’t arrive. This is what “properly protected” actually means in practice.
Why so many domains never get there
Reaching p=reject safely means being certain that every legitimate source of email from your domain — your Office 365 or Google Workspace, your invoicing software, your CRM, your email marketing platform, anything sending as “yourcompany.com” — is correctly authenticated first. Jump straight to reject without checking this, and you risk blocking your own legitimate emails along with the scammers’ fake ones.
That’s the real reason most businesses stall at p=none. It’s not that reject isn’t worth doing — it’s that getting there safely takes a proper review of every sending source first, and that review is easy to keep putting off. Which is exactly why so many domains stay wide open indefinitely: not from a decision to leave the door unlocked, but from never quite getting round to reviewing who’s behind it.
Why it’s worth the review
A domain sitting at p=none or without DMARC at all can be freely impersonated by anyone — a scammer can send a fake invoice, a fake password reset, or a fake “urgent payment” request that arrives looking exactly like it came from you, because nothing is stopping it. Beyond the immediate fraud risk, this also damages the trust your genuine emails rely on with providers like Gmail and Outlook, and it’s increasingly a requirement for getting onto supplier frameworks and passing due diligence with larger clients.
Getting to p=reject closes that gap for good. It’s the difference between a domain that’s merely being watched and one that’s actually locked down.
Where does your domain stand right now?
The only way to know whether you’re at none, quarantine, or reject — and what’s actually sending email as your domain in the meantime — is to check. It takes under a minute and it’s free.
Check your domain’s DMARC enforcement level now →
You’ll get a plain-English score out of 5, showing exactly how close you are to full protection and what’s standing in the way.
New to this topic? Start with our companion piece: What Is SPF and DKIM? A Plain-English Guide.
- Cyber Essentials vs Cyber Essentials Plus: What’s the Difference and Which Do You Need? - 13 October 2026
- What Is Payment Diversion Fraud? How It Works and How to Stop It - 6 October 2026
- Recruitment Firm Loses £90k to Phishing Email - 21 September 2026
