DMARC: Set is as p=none and read your reports from the RUA tags.
Once you are confident that all the legitimate mail is aligned, then go straight to p=reject. Many will recommend quarantine, but it's better to have an email bounce back immediately vs silently get lost in a spam folder. Outside of troubleshooting there isn't much use for P=Quarantine in DMARC or '~all' in SPF.
~all in SPF is a different beast, since -all breaks forwards. There's still an unreasonably large amount of people heavily reliant on forwards, so I'd not go as far as to recommend ~all to people who are not 100% certain of the consequences.
Comments
DMARC: Set is as p=none and read your reports from the RUA tags.
Once you are confident that all the legitimate mail is aligned, then go straight to p=reject. Many will recommend quarantine, but it's better to have an email bounce back immediately vs silently get lost in a spam folder. Outside of troubleshooting there isn't much use for P=Quarantine in DMARC or '~all' in SPF.
~all in SPF is a different beast, since -all breaks forwards. There's still an unreasonably large amount of people heavily reliant on forwards, so I'd not go as far as to recommend ~all to people who are not 100% certain of the consequences.