The DMARC policy is set by the p= tag in your _dmarc TXT record, defined in RFC 9989. It tells receivers what to do when both SPF and DKIM fail DMARC alignment.
p=none monitors, p=quarantine asks receivers to treat failures as suspicious, and p=reject asks receivers to reject them. sp controls subdomains, np controls non-existent subdomains, and t=y tests one policy level lower.
Start at none, align legitimate senders from aggregate-report evidence, test quarantine with t=y, enforce quarantine, then repeat the test step for reject. The older pct sampling tag is obsolete and should not be recommended for a current rollout.
Check it on your domain
- DMARC Checker: look up and validate a domain's DMARC record and policy.
- DMARC Generator: build a valid DMARC record from a simple form.
- DMARC Setup Wizard: build a safe, staged DMARC rollout plan from p=none to p=reject.