# How to Move DMARC From p=none to p=reject Safely

> Publish DMARC at p=none with a reporting address, read the aggregate reports to find every service that sends as your domain, fix SPF and DKIM alignment for each legitimate sender, then tighten the policy to quarantine and finally reject once reports show only mail you expect.

## Why the ladder exists

A DMARC policy tells receivers how to treat mail that fails authentication. Going straight to reject can block your own legitimate mail from a sender you forgot about. The ladder lets you learn before you enforce.

| Policy | What receivers do with failing mail |
| --- | --- |
| No DMARC | Deliver as usual. Receivers have no instruction from you. |
| p=none | Deliver as usual, and send you reports. |
| p=quarantine | Treat as suspicious, typically delivering to spam. |
| p=reject | Refuse the message during delivery. |

## The steps

1. **Publish p=none with a report address.** Add a TXT record at `_dmarc.yourdomain`, for example `v=DMARC1; p=none; rua=mailto:dmarc@yourdomain`.

2. **Collect reports.** Aggregate reports are XML files from receivers that list the sources sending as your domain and whether they passed.

3. **Inventory your senders.** Match each source to a system you own: your mail platform, marketing tool, support desk, billing system.

4. **Fix alignment.** For each legitimate sender, make SPF or DKIM pass with a domain that aligns with your From domain.

5. **Move to quarantine.** Once reports are clean, change to `p=quarantine`. The `pct` tag lets you apply the policy to a share of mail while you watch.

6. **Move to reject.** When quarantine produces no surprises, change to `p=reject`.

7. **Keep watching.** New tools and new senders appear over time. Keep reading reports.

## Pitfalls

- Subdomains that send mail may need their own alignment, or an explicit `sp=` policy.

- Forwarding and mailing lists can break SPF, which is why DKIM matters.

- Reports come from many receivers and arrive as compressed XML, so use a tool to read them.

## Questions

**How long does it take to reach p=reject?**
It depends on how many systems send as your domain. Many domains spend weeks at p=none and quarantine while senders are found and aligned.

**Will p=reject stop all spoofing?**
It stops mail that fails DMARC for your exact domain. Look-alike domains are separate registrations and need separate monitoring.

**What is the rua tag?**
The address where receivers send aggregate DMARC reports about mail claiming to be from your domain.

Tool: [See where your domain stands](https://www.emcheq.com/tools/dmarc-checker)