`p=reject`, ESPECIALLY for your personal email. `p=quarantine` is really only useful if you suspect your marketing department has set up some email blaster somewhere.

Realistically spoofed address (unauthenticated email) will be treated as spam and it’ll be implicitly quarantined or rejected as such by many well-known mail receivers. You can make this an explicit “reject” by publishing DMARC policy for your domain.

For example, gmail.com treats unauthenticated email as spam implicitly, regardless of DMARC policy.

That's what the policy setting tells the recipient. You can tell them to trest it as normal, send it to spam or delete it.

The report that they send you is useful for you to make sure your emails that you expect to go through are going through.

Reject it in the SMTP transaction.