Your record says p=none and you are being asked to make it say p=reject before the sale. That edit does not raise inbox placement. It tells receivers what to do with mail that fails DMARC, including the review app nobody added to DNS.
None of Gmail, Yahoo, or Microsoft requires a policy stronger than p=none for bulk senders. That does not make p=none the end state: it leaves spoofed mail undirected, so enforcement is still worth reaching once your reports are clean.
Last verified: 26 September 2026, against RFC 9989 and the Gmail and Yahoo bulk-sender pages.
What each policy actually asks for
| Policy | What you are asking receivers to do | When it is the wrong edit |
|---|---|---|
p=none |
Deliver the mail. Send you reports. | Never as a permanent excuse to ignore a source that is spoofing you. Fine while you are still finding your own senders. |
p=quarantine |
Treat failures as suspicious. | Your own order or campaign mail is still failing alignment. |
p=reject |
Reject failures. Receivers are not required to reject on this tag alone. | Forwards, mailing lists, or a vendor you still need are in the failure report. |
Gmail’s bulk requirement is a DMARC record. The policy may be none. Yahoo’s is the same, and Yahoo also says DMARC must pass, which is alignment, not “the policy tag must be reject.” What DMARC is explains the tags. DMARC in 2026 is what RFC 9989 changed, including the warning on p=reject. This page is only the sequence.
How to move DMARC to enforcement, in order
- Collect reports. If you have no
rua, you are guessing. No DMARC record is the setup case. - Open the sources. Unknown senders separates a vendor from spoofing. Fix vendors by giving them a selector on your domain. Multiple DKIM selectors is how two vendors coexist.
- Prefer aligned DKIM over “SPF will carry us.” Forwarded mail often breaks SPF and keeps DKIM. RFC 9989 requires DKIM, not SPF alone, if you do publish
p=reject. - Move to
p=quarantinewhen the failures are not your streams. Watch receipts the same day. A receipt in spam or a bounce that names policy means you quarantined yourself. - Consider
p=rejectonly after another stretch of clean reports. BIMI’s logo programs want quarantine or reject. That is a BIMI prerequisite, documented on the BIMI page. It is not a Gmail placement requirement. Do not takep=rejectfor a logo if the reports are not clean.
There is no provider clock that says “two weeks at none, then reject.” “A few weeks” in older explanations is an operating habit so that a weekly vendor shows up in a report. It is not an RFC timer.
What DMARC enforcement will not do
It will not pull authenticated marketing out of the spam folder. Complaint rate still decides that. It will not fix a 10-lookup SPF permerror. It will not make Outlook accept high-volume mail that fails SPF or DKIM. Those are different checks, on the Outlook guide.
If you publish p=reject and legitimate mail starts bouncing, put the policy back to the last value that let that mail through, fix the source, then try again. Leaving a broken reject in place to “look enforced” blocks customers.
InboxEagle
Check the record before you change p=
The free DMARC checker shows the policy, alignment mode, and report address you publish now. Change p= only after your aggregate reports list nothing but mail you do not send.
Sources
- DMARC, RFC 9989. Section 7.4 on
p=reject, and the rule that reject domains must DKIM-sign. - Email sender guidelines, Google. Bulk senders publish DMARC.
p=noneis allowed. - Sender best practices, Yahoo. DMARC at
p=noneor stronger, and the message must pass DMARC.