What each DMARC policy requests
p=none asks receivers to monitor mail that fails DMARC without applying a DMARC-specific disposition. p=quarantine asks receivers to treat failures as suspicious, often by placing them in spam. p=reject asks receivers not to accept messages that fail DMARC.
Receivers make the final delivery decision, so a policy is a request rather than a guarantee. Enforcement still reduces straightforward spoofing and gives receivers a clear signal.
When to move beyond p=none
Stay at p=none long enough to identify every legitimate sending source in aggregate reports. Fix alignment for business mail, marketing systems, support tools, billing platforms, and any service that sends with your From domain.
Use pct to stage enforcement only when you understand how receivers apply it. Continue reviewing reports while moving from quarantine to reject, and set an explicit subdomain policy when subdomains have different mail behavior.
A practical migration sequence
Publish reporting at p=none, classify sources, repair authentication, then move to quarantine. After legitimate traffic consistently passes, adopt reject. Keep monitoring after enforcement because vendors, keys, and sending infrastructure change.