Skip to content
Webmaster Tools
EmailEmail DeliverabilityDMARC p=reject

DMARC p=reject

What a DMARC policy of p=reject does, what senders see when their mail fails it, and how to get to reject safely without losing legitimate email.

What p=reject means

p=reject is the strictest DMARC policy. It asks receivers to refuse mail that claims to come from your domain but fails DMARC, usually during the SMTP conversation, so the message never reaches the recipient's inbox or spam folder. It is the only policy that actually stops direct spoofing of your domain.

_dmarc.example.com.  3600  IN  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com"

Receivers still make the final call. RFC 7489 lets them deviate from the policy, for example for mailing lists or known forwarders, and some deliver to spam instead of rejecting.

What it looks like

For a message that passes, nothing changes. For a spoofed or misconfigured one, the receiver writes the result in Authentication-Results:

Authentication-Results: mx.google.com;
       spf=fail smtp.mailfrom=example.com;
       dmarc=fail (p=REJECT sp=REJECT dis=REJECT) header.from=example.com

The sending server gets an SMTP rejection. Gmail answers with 550 5.7.26 and a message that the email is unauthenticated and not accepted due to the domain's DMARC policy; see 550 5.7.26. Other providers use other wording and sometimes 550 5.7.1 (550 5.7.1). If you have a bounced message, the Email Header Analyzer shows which check failed.

Getting there safely

  1. Start at p=none with rua= reports and fix every legitimate source.
  2. Move to p=quarantine, ramping pct from a small value to 100.
  3. Switch to p=reject, again optionally with pct, and keep watching the reports.

Each legitimate source needs at least one aligned pass. DKIM is the one that matters most: it survives forwarding, while SPF does not.

v=DMARC1; p=reject; sp=reject; adkim=r; aspf=r; rua=mailto:dmarc-reports@example.com

Domains that don't send mail

Parked domains and domains used only for websites are attractive for spoofing because nobody watches them. Lock them down completely:

example.net.          TXT  "v=spf1 -all"
_dmarc.example.net.   TXT  "v=DMARC1; p=reject; sp=reject"
example.net.          MX   0 .

The null MX (RFC 7505) also tells senders the domain receives no mail.

Side effects to expect

  • Mailing lists. A list that changes the subject or adds a footer breaks DKIM. Mail from your users to such lists can be rejected by other members' providers. Most modern list software rewrites the From address for domains with strict policies.
  • Plain forwarding. SPF fails after a forward; DKIM usually survives unless the forwarder modifies the message.
  • Your own forgotten senders. A server that sends cron mail or alerts "from" your domain with no DKIM will be rejected. Give it a subdomain or route it through your provider.
  • Subdomains. Without sp=, they inherit p=reject. That is usually what you want, but check reports for subdomain senders first.

See your current policy in the DMARC Checker, and check SPF, DKIM and DMARC together with the Email Checker.