Start verifying

Mail security

How to Move DMARC From p=none to p=reject Safely

By EMCHEQ · Updated · 2 min read

In short. Publish DMARC at p=none with a reporting address, read the aggregate reports to find every service that sends as your domain, fix SPF and DKIM alignment for each legitimate sender, then tighten the policy to quarantine and finally reject once reports show only mail you expect.

Why the ladder exists

A DMARC policy tells receivers how to treat mail that fails authentication. Going straight to reject can block your own legitimate mail from a sender you forgot about. The ladder lets you learn before you enforce.

PolicyWhat receivers do with failing mail
No DMARCDeliver as usual. Receivers have no instruction from you.
p=noneDeliver as usual, and send you reports.
p=quarantineTreat as suspicious, typically delivering to spam.
p=rejectRefuse the message during delivery.

The steps

  1. Publish p=none with a report address. Add a TXT record at _dmarc.yourdomain, for example v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.
  2. Collect reports. Aggregate reports are XML files from receivers that list the sources sending as your domain and whether they passed.
  3. Inventory your senders. Match each source to a system you own: your mail platform, marketing tool, support desk, billing system.
  4. Fix alignment. For each legitimate sender, make SPF or DKIM pass with a domain that aligns with your From domain.
  5. Move to quarantine. Once reports are clean, change to p=quarantine. The pct tag lets you apply the policy to a share of mail while you watch.
  6. Move to reject. When quarantine produces no surprises, change to p=reject.
  7. Keep watching. New tools and new senders appear over time. Keep reading reports.

Pitfalls

  • Subdomains that send mail may need their own alignment, or an explicit sp= policy.
  • Forwarding and mailing lists can break SPF, which is why DKIM matters.
  • Reports come from many receivers and arrive as compressed XML, so use a tool to read them.

Questions

How long does it take to reach p=reject?
It depends on how many systems send as your domain. Many domains spend weeks at p=none and quarantine while senders are found and aligned.
Will p=reject stop all spoofing?
It stops mail that fails DMARC for your exact domain. Look-alike domains are separate registrations and need separate monitoring.
What is the rua tag?
The address where receivers send aggregate DMARC reports about mail claiming to be from your domain.

Related guides

Mail security

SPF, DKIM and DMARC explained

SPF lists who may send for your domain, DKIM signs messages, DMARC sets the policy. Learn the records, qualifiers, alignment and common mistakes.

Read the guide →