p=reject
The strictest DMARC policy: the domain owner considers any failure a clear sign the use of its domain is not valid, and asks receivers to refuse the message.
What it means
Receivers that honour p=reject normally refuse failing mail during the SMTP session, so it never reaches the recipient. Gmail, for example, returns 550 5.7.26 citing the sender's DMARC policy. This gives the strongest protection against direct spoofing of the domain.
It also exposes every flaw in the domain's setup: a sending service that is not aligned, or mail relayed through a forwarder or mailing list that breaks DKIM, gets bounced. RFC 9989 therefore says a domain at p=reject must DKIM-sign its mail rather than rely on SPF alone, and that domains whose users post to mailing lists should not publish p=reject.
The RFC suggests at least a month at p=none and as long again at p=quarantine, comparing results in aggregate reports, before reject. A domain that sends no mail at all can go straight to p=reject.
Example
v=DMARC1; p=reject; rua=mailto:dmarc@example.comRelated terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
- RFC 9989: Domain-based Message Authentication, Reporting, and Conformance (DMARC), section 4.7rfc-editor.org
- RFC 9989: Domain-based Message Authentication, Reporting, and Conformance (DMARC), section 7.4rfc-editor.org
- RFC 9989: Domain-based Message Authentication, Reporting, and Conformance (DMARC), section 7.2rfc-editor.org
All 432 terms in the glossaryThe wiki: blocklists and bounce codes