Does every MBP respect DMARC the same way?

You've published a DMARC policy at p=reject and you feel like the hard work is done. But here's the thing: not every mailbox provider reads that policy the same way, and some don't follow it precisely at all.

The big players, Gmail, Outlook, and Yahoo Mail, generally enforce DMARC policies closely. If you say p=reject, they'll reject. If you say p=quarantine, they'll move the message to spam. These three handle the majority of consumer inboxes, so their compliance matters most for most senders.

But outside that group, the picture gets messier. Smaller regional providers may honor the spirit of your policy but apply it inconsistently. Some will quarantine messages even when your policy says p=reject, treating any failure as a softer signal. Others will quietly deliver a failing message anyway, especially if the sender has an existing reputation with that provider.

Corporate email environments add another layer. Companies running their own Microsoft 365 or on-premise Exchange servers often have security overlays, gateway filters, or custom allow-lists that can override DMARC outcomes. A message that would be rejected at a consumer inbox might sail through a corporate system because an IT team whitelisted your domain years ago.

What does this mean practically? A few things worth keeping in mind:

• Don't assume p=reject means zero spoofed email will ever land anywhere. It dramatically reduces it, but edge cases exist.
• Before tightening your policy from p=none to p=quarantine to p=reject, check your DMARC aggregate reports to spot providers that are handling your messages in unexpected ways.
• If a major chunk of your audience sits behind corporate firewalls, test delivery there explicitly. What clears Gmail without a problem might behave differently inside a filtered enterprise environment.

DMARC is still one of the most important tools you have for protecting your domain from spoofing. You just want to go in knowing it's a strong standard, not a universal law. You can check how your DMARC record is set up with our free DMARC Parser, or if something feels off, our SOS hotline is free and we actually pick up.