DMARC from p=none to p=reject: step by step without blocking your own mail
You move from p=none to p=reject in four stages: first weeks of collecting reports, then getting every source that sends on behalf of your domain in order, then quarantine on a small percentage, and reject last of all. Skip a stage and you usually block your own invoicing package or webshop. Allow a few months, not an afternoon.
Why not straight to reject
DMARC tells the recipient what to do with mail that presents itself as your domain but fails the check. The catch is that "fails the check" also applies to your own legitimate mail as long as it is not correctly aligned. An invoicing module sending through an old server, a contact form on the website, a supplier sending a survey in your name: all of them fail until you fix them. Set p=reject today and that mail disappears tomorrow without any error message on your side.
Step 1: p=none with reporting
Publish a DMARC record with policy none and a reporting address. This blocks nothing; it simply makes recipients tell you daily who sent on behalf of your domain and whether it passed. Do not use a personal mailbox as the reporting address: the reports are XML files and there will be many. Have them processed by a tool that summarises them per sending source.
Step 2: read for at least four weeks
Leave the record for a month. Invoicing runs monthly, some reminders quarterly, and you want to see all of them. Make a list of every source that appears in the reports and decide for each: is this ours, and if so, who manages it? You almost always find more than you expected. An old form on the website, a till system in a branch, a CRM that an employee once connected.
Step 3: fix every legitimate source
Per source there are three options. Either you add the source to your SPF record and make sure the sender domain matches. Or you have the source sign with DKIM for your domain, which is more robust because it survives forwarding. Or you move the source to an SMTP relay where both are already arranged and every application gets its own login. That last route is usually the shortest, certainly for systems nobody remembers the access to. Whatever you do not recognise as legitimate, let it fail: that is exactly what DMARC is for.
With SPF, mind the limit of ten DNS lookups. Add every supplier blindly and you exceed it, after which SPF fails for everyone. Prune what is no longer used.
Step 4: quarantine on a small percentage
Once the reports have shown only passing legitimate sources for a few weeks, set the policy to quarantine with a percentage of, say, ten. Only a tenth of failing mail is then filed as spam. If nobody notices anything, raise it to fifty and later to a hundred. Keep reading the reports; a source that only sends once a quarter may only surface now.
Step 5: reject
When quarantine at a hundred percent has run for a few weeks without complaints, set the policy to reject. Failing mail is now refused rather than filed as spam. Do not forget your subdomains: without a separate setting they inherit the policy of the main domain, which is usually what you want, but check that no sending subdomain is still out of order.
What you keep doing afterwards
Keep reading reports, less often but regularly. Every new supplier that sends in your name goes into authentication first and into production second. Put that in the checklist for connecting a new system, or the story starts again. If you want to understand the reports, our deliverability page explains what the figures mean.
Frequently asked questions
How long does the whole process take?
For a small company with three sending systems, two to three months. For an organisation with many departments and suppliers, longer. The time goes not into DNS changes but into finding out who is sending.
What if a supplier cannot sign DKIM for my domain?
Then SPF remains, with the caveat that forwarded mail will fail. Consider having that supplier send from a separate subdomain, so your main domain can stay strict.
Is p=quarantine not good enough?
For many purposes it is. But only with reject are you sure that forged mail does not even reach a spam folder, and some applications, such as a logo in the inbox, require enforcement.