How to move DMARC from p=none to p=reject safely

p=none only watches. Spoofed email using your domain still gets delivered. Getting to p=reject blocks it, but moving too fast can block your own invoices and newsletters. This is the safe path.

Step 1: Monitor with reports (2–4 weeks)

Publish p=none with a report address (rua=mailto:…). The DMARC generator builds this for you. Mailbox providers will send daily XML reports listing every server that sent mail as your domain and whether it passed. Raw XML is hard to read, so most people use a free or paid DMARC report viewer.

Step 2: Make every legitimate sender pass

For each service in the reports (your email provider, CRM, newsletter tool, billing system, help desk), make sure it passes SPF or DKIM, aligned with your From domain:

• DKIM (best): turn on DKIM signing in each service using your domain, and publish the key it gives you.
• SPF: add the service to your SPF record, but watch the 10-lookup limit.
• Unknown senders that aren't yours are exactly what DMARC will block. Leave them failing.

Step 3: Quarantine a slice, then all of it

Switch to p=quarantine; pct=25. A quarter of failing mail goes to spam while you watch for complaints ("my invoice went to spam"). Raise to 50, then 100 over a week or two.

Step 4: Reject

When reports show only unauthorized senders failing, move to p=reject. You can use pct again to ramp up. Consider sp=reject as well so attackers can't spoof unused subdomains.

Step 5: Keep watching

New tools get added all the time. Keep the rua reports on and re-check your domain after adding any service that sends email for you.

Common mistakes

• Jumping straight to reject without reports. You won't know what you broke.
• Two DMARC records. Receivers ignore both, so keep one.
• Relying only on SPF. Forwarded mail breaks SPF but keeps DKIM, so DKIM is what keeps forwarded mail passing.