ESA DMARC profile vs content filter best practices

[Ajit Pai]

Hello community,

is there a difference between the implementation of DMARC using the Cisco ESA "DMARC profile"My DMARC profile

and a simple content filter that checks strings like p=none or p=quarantine in the authentication results headers?My DMARC content filter

In my specific scenario I want to quarantine mail that fails DMARC only with p=quarantine. Can you confirm that the DMARC-failed-mail with "p=none" can only be managed by content filters?

Are there any best practices that can be applied?

Thank you and best regards,

Luca

[Ken Stieers]

Correct, you have to deal with NONE via a content filter.
The only difference might be when the action happens, which could when you think about all of the filtering that is going on, and if you have other content filters that apply, etc.
I'd expect that DMARC policy will quarantine earlier, but the Email Pipeline flowcharts don't show it, so I don't know.
Ken