DMARC p=none to p=reject: a safe step-by-step path

A DMARC record with p=none tells receiving mail servers to report on email that fails authentication, and to deliver it anyway. It is the right place to start and the wrong place to stay: anyone can still send email that shows your exact domain in the From line, and it will reach your customers' inboxes.

p=reject tells receivers to refuse those messages. Getting there safely is a matter of finding every legitimate sender first.

How DMARC decides

A message passes DMARC when SPF or DKIM passes and is aligned with the domain in the visible From address:

SPF alignment: the envelope sender (Return-Path) domain matches the From domain.
DKIM alignment: the d= domain in the DKIM signature matches the From domain.

By default, alignment is relaxed, so mail.example.com aligns with example.com. Many services pass SPF with their own domain, which doesn't align. That is why DKIM signing with your domain matters for every sending service.

Step 1: collect reports (2–4 weeks)

Publish p=none with an address for aggregate reports:

_dmarc.example.com  TXT  "v=DMARC1; p=none; rua=mailto:[email protected]"

Receivers such as Google, Microsoft and Yahoo send a daily XML report listing every IP that sent mail as your domain and whether it passed. The raw files are hard to read, so use a DMARC report viewer.

Step 2: fix every legitimate sender

Go through the sources in the reports:

Your mailbox provider (Microsoft 365, Google Workspace): turn on DKIM signing for your domain.
Every service that sends as you: CRM, marketing platform, helpdesk, invoicing, the website's contact form. Add DKIM records for each, and include it in SPF if it uses your domain as the envelope sender.
Forwarders and mailing lists may break SPF. DKIM usually survives forwarding, which is another reason to sign everything.
Anything you don't recognise is either a forgotten tool or someone impersonating you. Both are worth knowing about.

Keep going until nearly all legitimate mail passes, aligned.

Step 3: quarantine, gradually

_dmarc.example.com  TXT  "v=DMARC1; p=quarantine; pct=25; rua=mailto:[email protected]"

Failing mail now goes to spam for the share set by pct. Watch the reports and helpdesk for a week, then raise pct to 50 and 100.

Step 4: reject

_dmarc.example.com  TXT  "v=DMARC1; p=reject; rua=mailto:[email protected]"

Keep the reports coming. New tools get added, and the reports show you when one starts sending without DKIM.

Enforcement also unlocks your logo in Gmail and other inboxes (BIMI) and is what cyber insurers mean when they ask about DMARC (DMARC for cyber insurance).

Don't forget subdomains and parked domains

sp= sets the policy for subdomains. Without it they inherit p=.

Domains that never send email should say so, so they can't be used for spoofing either:

example.net         TXT  "v=spf1 -all"
_dmarc.example.net  TXT  "v=DMARC1; p=reject"

What DMARC doesn't cover

DMARC protects your exact domain. It does nothing against lookalikes such as examp1e.com, which pass their own checks. See Someone is pretending to be my company and how to report a lookalike domain. It also doesn't protect mail sent to you in transit; that's MTA-STS.

Check your domain

The free scan reads your DMARC policy, checks your SPF record and its lookup count, and lists lookalike domains that can send email.