Guides › DMARC

Moving DMARC from p=none to p=reject safely

1. Weeks 0–4: p=none with rua. Collect aggregate reports and list every service sending as your domain (CRM, helpdesk, invoicing, newsletters).
2. Fix each source. Add DKIM signing with your domain, or SPF with a custom return path, until it shows aligned passes.
3. p=quarantine; pct=25, then 50, then 100 over a few weeks while watching reports.
4. p=reject once failures are only spoofing or forwarding noise.

v=DMARC1; p=none; rua=mailto:dmarc@example.com
v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@example.com
v=DMARC1; p=reject; rua=mailto:dmarc@example.com

Gmail and Yahoo only require p=none for bulk senders, but only quarantine and reject actually stop spoofing. The monitoring plan alerts you if your DMARC, SPF or DKIM records change unexpectedly during the rollout.

Related