DMARC is the record that ties SPF and DKIM together and tells receivers what to do when a message fails those checks. On cold email domains it matters twice: it protects the domain from spoofing, and large mailbox providers now expect to see it.
What the policy values mean
The policy tag, written as p, has three settings. With p=none, receivers only monitor and report. Nothing is blocked, which makes it the safe starting point. With p=quarantine, failing mail is treated with suspicion and usually sent to spam. With p=reject, failing mail is refused outright.
Two other tags matter. The rua tag is the email address that receives aggregate reports, which show who is sending as your domain and whether those sends pass. The sp tag sets the policy for subdomains, which is worth setting on outreach setups that use separate sending subdomains.
Why jumping to p=reject breaks mail
Enforcement punishes every sender that is not aligned. If a tool, a CRM, a warmup service, or an old inbox sends as your domain without passing SPF or DKIM alignment, p=reject tells receivers to refuse that mail. People discover this the hard way when invoices, notifications, or their own outreach suddenly vanish.
The safe order is always the same: monitor first, fix what the reports show, then enforce.
The safe path, step by step
- Publish a record at p=none with an rua address you actually read. Build the exact value with the DMARC Record Generator so the syntax is right the first time.
- Send normally for one to two weeks and watch the aggregate reports. List every source that sends as the domain.
- Fix alignment for each source: add the sender to SPF, or get DKIM signing set up with your domain. Check the full picture with the Email Authentication Checker.
- Move to p=quarantine once reports show your real senders passing. Keep watching reports for another week or two.
- Move to p=reject when quarantine reports stay clean. Your domain is now protected and aligned.
Notes for secondary outreach domains
Cold email usually runs on secondary domains, and each one needs its own DMARC record. Do not assume the main domain record covers them. Also set the subdomain policy if you send from subdomains, and keep the same careful order on every domain: none, then quarantine, then reject. If you also need to review SPF limits while you align senders, the SPF Checker shows lookup counts and common record errors.
The short version
Start at p=none, read the reports, fix alignment, then step up to quarantine and finally reject. DMARC done in that order protects the domain without breaking the mail you actually send.
FAQ
Should a new cold email domain start at p=reject?
No. Start at p=none so you can see every sender in the reports before anything gets blocked.
How long should I stay at p=none?
Long enough to see all your senders in reports, usually one to two weeks of normal sending.
What if I do not read the rua reports?
Then stay at p=none. Enforcement without reading reports is how legitimate mail gets blocked by surprise.