The policies step up in strength. p=none expresses no preference, so it's used to watch what's happening. p=quarantine tells receivers that failing mail is suspicious. p=reject tells them a failure means your domain is being used without permission. The current specification is RFC 9989, which replaced the older one in May 2026.
The specification also describes how to roll it out: start at p=none with reports switched on, use the reports to find every legitimate service that sends as your domain, fix the ones that fail, and only then move to quarantine or reject. It says that can take many months for a domain that sends a lot of mail.
It matters more than it used to. Since February 2024, Gmail has required anyone sending five thousand or more messages a day to personal Gmail accounts to publish a DMARC record, alongside SPF and DKIM.
Updated September 2026
Check it yourself