The Email Stack Scan a domain
← All guides
Authentication

Moving DMARC from p=none to p=reject without losing mail

The staged rollout that gets you to full enforcement without dropping a single legitimate message.

Publishing p=reject on day one is how people lose real mail. The safe path to enforcement is gradual: you watch, you fix, and only then you enforce. Here is the rollout that works.

Stage 1 — Publish p=none and watch

Start with a monitoring-only policy. It changes nothing about delivery, but it turns on reporting.

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

The rua address is where receivers send daily aggregate reports. Point it at an inbox you check, or a DMARC reporting service that turns the XML into something readable. Build the record with our DMARC generator.

Leave this running for two to four weeks. Your goal is a complete inventory of every source sending mail as your domain — your ESP, your transactional provider, your CRM, your helpdesk, that one form tool marketing set up years ago.

Stage 2 — Align every legitimate sender

For each source in your reports, confirm it passes DMARC through alignment: the domain in its SPF or DKIM must match your From domain. Most providers offer a setup step that adds a signing subdomain — do it for every one.

Do not move on until your reports show all legitimate mail passing. Anything still failing here would be rejected once you enforce.

Stage 3 — Quarantine, ramped

Move to quarantine, but apply it to only a fraction of failing mail at first using pct:

v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@yourdomain.com

Watch for a week. If nothing legitimate lands in spam, raise pct to 50, then 100. This limits the blast radius if you missed a sender.

Stage 4 — Reject

Once quarantine at 100% is clean, enforce:

v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com

Now anything that fails authentication is rejected outright. Spoofed mail claiming to be you no longer reaches inboxes.

What breaks, and how to handle it

  • Forwarding breaks SPF (the forwarding server becomes the sender). DKIM survives forwarding, which is why DKIM alignment matters most.
  • Mailing lists often rewrite messages, breaking DKIM. Ask senders on affected lists to use a subdomain, or accept that list mail may need a softer policy.
  • New third-party tools added after you enforce will fail until aligned. Keep rua monitoring on permanently so you catch them.

Check your live policy any time with our DMARC checker.

Check your own domain