DMARC: what happens to mail that fails your checks?

DMARC ties SPF and DKIM together and tells receivers what to do when both fail: nothing (p=none), spam-folder it (p=quarantine), or refuse it (p=reject). It also asks for aggregate reports (rua) — XML digests showing who is sending as your domain, including attackers.

The ladder: monitor with p=none and rua first, confirm your legitimate mail aligns, then step to quarantine and finally reject. Stuck at p=none forever is the most common deliverability failure we see — you get reports nobody reads and no protection at all.

Other tools: SPF · DMARC · llms.txt · Header analyzer