Reviewed by: QuickDMARC Security Team · Email Authentication Specialists · Last reviewed: 2026-08-31

DMARC Reject

DMARC p=reject asks receivers to refuse mail that fails DMARC. It is the strongest common domain policy against direct domain spoofing.

What this policy does

When honored, failing messages are rejected at SMTP time instead of delivered. BIMI programs typically require enforced DMARC (quarantine or reject).

v=DMARC1; p=reject; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1

When to use it

Move to reject after quarantine (or carefully after thorough p=none analysis) when legitimate sources pass SPF or DKIM alignment consistently.

Troubleshooting before you change policy

Check aggregate reports for unknown sources, SPF PermError, missing DKIM selectors, and From domains that do not match signing domains.

Run a DMARC checker on the apex and major sending subdomains
Validate SPF lookup count under 10
Confirm DKIM for Microsoft 365 / Google / ESPs
Fix or retire shadow IT senders

Microsoft 365 & Google Workspace

Policy lives in your public DNS, not inside the M365 or Google admin center. Ensure Exchange Online and Google Workspace mail are aligned before quarantine/reject.

How QuickDMARC helps

QuickDMARC monitors pass/fail trends and helps you change Managed DMARC policy when ready—without guessing from incomplete mailbox samples.

Frequently asked questions

Does DMARC Reject stop spoofing by itself?

It substantially reduces direct spoofing when receivers honor the policy and your legitimate mail stays aligned.