It depends a lot on the specific case. If you are really sure you know where all the mail being sent is coming from, and that you’ve set up SPF & DKIM appropriately, then you might go directly to p=reject
or p=quarantine
.
The safer course is to do a staged roll-out, e.g.:
p=none
with rua
and/or ruf
set (there are tools like Dmarcian that you can use to help process the reports you get). Do this to make sure that everything that’s going to fail should actually fail, or fix things that you spot that you hadn’t thought about.
p=quarantine
with a low percentage just to check that things are ok in practice - if you get lots of issues, then at least it’s (a) likely available in the recipient’s quarantine, and (b) only a small amount of the mail
p=quarantine
with 100%, maybe with other steps in between. You might stop here.
p=reject
, again maybe doing percentage steps, if you’re completely certain that failing mail should never be read by the recipient.
One thing to consider when deciding between quarantine
and reject
is that failures can be out of your control. For example, if someone is forwarding mail, then it’s likely there’s going to be an SPF failure (particularly if it’s not well set up) but the recipient probably does actually want the email. Similarly, if there’s something in the chain that mucks about with the message (often the subject) then there may be a DKIM failure but it’s still a legitimate message.
If you really want to say “the mail comes directly from me to you”, then reject
is likely where you want to get to. If you’re ok with “the mail comes directly from me to you, and if you muck about with that then it may end up in your quarantine”, then quarantine
is a better end point.