# DMARC p=none to p=reject: a safe step-by-step path

A DMARC record with `p=none` tells receiving mail servers to report on email
that fails authentication, and to deliver it anyway. It is the right place to
start and the wrong place to stay: anyone can still send email that shows your
exact domain in the From line, and it will reach your customers' inboxes.

`p=reject` tells receivers to refuse those messages. Getting there safely is a
matter of finding every legitimate sender first.

## How DMARC decides

A message passes DMARC when **SPF or DKIM passes and is aligned** with the
domain in the visible From address:

- **SPF alignment:** the envelope sender (Return-Path) domain matches the From
  domain.
- **DKIM alignment:** the `d=` domain in the DKIM signature matches the From
  domain.

By default, alignment is relaxed, so `mail.example.com` aligns with
`example.com`. Many services pass SPF with *their own* domain, which doesn't
align. That is why DKIM signing with your domain matters for every sending
service.

## Step 1: collect reports (2–4 weeks)

Publish `p=none` with an address for aggregate reports:

```
_dmarc.example.com  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"
```

Receivers such as Google, Microsoft and Yahoo send a daily XML report listing
every IP that sent mail as your domain and whether it passed. The raw files
are hard to read, so use a DMARC report viewer.

## Step 2: fix every legitimate sender

Go through the sources in the reports:

1. **Your mailbox provider** (Microsoft 365, Google Workspace): turn on DKIM
   signing for your domain.
2. **Every service that sends as you:** CRM, marketing platform, helpdesk,
   invoicing, the website's contact form. Add DKIM records for each, and
   include it in SPF if it uses your domain as the envelope sender.
3. **Forwarders and mailing lists** may break SPF. DKIM usually survives
   forwarding, which is another reason to sign everything.
4. **Anything you don't recognise** is either a forgotten tool or someone
   impersonating you. Both are worth knowing about.

Keep going until nearly all legitimate mail passes, aligned.

## Step 3: quarantine, gradually

```
_dmarc.example.com  TXT  "v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@example.com"
```

Failing mail now goes to spam for the share set by `pct`. Watch the reports
and helpdesk for a week, then raise `pct` to 50 and 100.

## Step 4: reject

```
_dmarc.example.com  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"
```

Keep the reports coming. New tools get added, and the reports show you when
one starts sending without DKIM.

Enforcement also unlocks your logo in Gmail and other inboxes
([BIMI](/guides/bimi-vmc-vs-cmc)) and is what cyber insurers mean when they
ask about DMARC ([DMARC for cyber insurance](/guides/dmarc-cyber-insurance)).

## Don't forget subdomains and parked domains

- `sp=` sets the policy for subdomains. Without it they inherit `p=`.
- **Domains that never send email** should say so, so they can't be used for
  spoofing either:

  ```
  example.net         TXT  "v=spf1 -all"
  _dmarc.example.net  TXT  "v=DMARC1; p=reject"
  ```

## What DMARC doesn't cover

DMARC protects your exact domain. It does nothing against lookalikes such as
`examp1e.com`, which pass their own checks. See
[Someone is pretending to be my company](/guides/someone-is-pretending-to-be-my-company)
and [how to report a lookalike domain](/guides/report-lookalike-domain-takedown).
It also doesn't protect mail sent **to** you in transit; that's
[MTA-STS](/guides/mta-sts-tls-rpt).

## Check your domain

The free scan reads your DMARC policy, checks your SPF record and its lookup
count, and lists lookalike domains that can send email.

## Sources

- [RFC 7489: DMARC](https://www.rfc-editor.org/rfc/rfc7489)
- [Google: email sender guidelines](https://support.google.com/a/answer/81126)
- [Microsoft: set up DMARC for Microsoft 365](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configure)

---
Source: https://nameward.app/guides/dmarc-none-to-reject (updated 2026-10-29)