What’s the difference between DMARC p=none and p=quarantine?

The p= tag in a DMARC record tells receiving servers what to do with email that fails your authentication checks. There are three settings:

• p=none means do nothing - deliver the failing mail anyway and just send you reports.
• p=quarantine means treat it as suspect, which in practice routes it to spam.
• p=reject goes further and refuses delivery outright.

The difference matters because p=none offers no protection: a fraudster sending invoices from your exact domain passes through unimpeded. 40% of Australian small business domains publish a DMARC record without an enforcing policy, and about 1 in 6 have no DMARC record at all^* - a record at p=none looks done while changing nothing. The honest sequence: start at p=none, read the reports for a few weeks, fix the legitimate senders that are failing, then move to quarantine. p=none is the rehearsal; quarantine is the performance - schedule the opening night.