Guide

Moving DMARC from p=none to p=reject

A safe rollout plan for DMARC: start monitoring, read the aggregate reports, fix legitimate senders, and step up to quarantine and reject without losing mail.

A DMARC record at p=none protects nothing: it asks receivers to deliver spoofed mail as normal. Its value is the reports, which tell you what you need to know to enforce safely. The goal is p=reject.

Step 1: monitor

Publish a record at _dmarc. your domain with a reporting address:

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

Large receivers such as Google, Microsoft and Yahoo will send a daily XML aggregate report listing every IP address that sent mail claiming to be you, and whether SPF and DKIM passed and aligned. The raw XML is hard to read; a DMARC reporting service will summarise it. If the reporting address is at another domain, that domain has to publish an authorisation record, which those services set up for you.

Step 2: fix your legitimate senders

Give it two to four weeks so monthly mailings and rarely used systems show up. For each source in the reports that is really you:

  • Turn on DKIM signing with your own domain. This is the most robust fix, because DKIM survives forwarding.
  • Add the service to your SPF record, and if possible set its bounce (envelope) domain to yours, so SPF aligns too.

Sources you do not recognise are either something you forgot, or someone spoofing you. The second is what enforcement will stop.

Step 3: quarantine

v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com

Failing mail now goes to spam rather than disappearing, so a missed sender is noticed and recoverable. Older guides suggest ramping up with pct=25, then 50, then 100. RFC 9989 removed pct in 2026 and updated receivers ignore it; the replacement is t=y, which asks receivers to apply the policy one level lower while you test. See what changed in DMARC.

Step 4: reject

v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com

Once a few weeks of reports at quarantine show nothing legitimate failing, switch to reject. Keep reading the reports: a new tool someone signs up for next year will fail until it is set up properly, and the reports are how you will find out.

Subdomains

A subdomain without its own record inherits the parent's policy, or sp= if set, or np= if the subdomain does not exist at all. Avoid sp=none and np=none once the parent is enforcing: a spoofer will simply invent a subdomain.

Before p=reject

RFC 9989 says a domain publishing p=reject must sign its mail with DKIM rather than relying on SPF alone, because SPF breaks when mail is forwarded. Make sure every source in the reports passes DKIM, not just SPF.

Check your DMARC policy

More guides

  • SPF, DKIM and DMARC explained How the three email authentication standards fit together, what each one proves, and which you need to stop people sending email as your domain.
  • How to create an SPF record Build a correct SPF record step by step: find every service that sends as you, add the right includes, pick between -all and ~all, and avoid the common mistakes.
  • Fixing "SPF PermError: too many DNS lookups" Why SPF stops at 10 DNS lookups, how the count is worked out across nested includes, and four ways to bring a record back under the limit.
  • What DKIM is and how to set it up How DKIM signatures work, where the public key lives in DNS, what a selector is, and how to turn DKIM on for the services that send your mail.
  • How to secure a domain that sends no email Parked and website-only domains are easy targets for spoofing. Three DNS records — null MX, a deny-all SPF record and DMARC reject — lock them down.
  • DMARCbis: what changed in DMARC in 2026 (RFC 9989) DMARC was revised in May 2026 as RFC 9989, 9990 and 9991. What is new, what was removed — pct, rf and ri — and what to change in your record.
  • DKIM2: the next version of DKIM, explained DKIM2 is an IETF draft that chains signatures across every hop, records how intermediaries change a message, and stops DKIM replay. What it does and where it stands.
  • How to set up MTA-STS and TLS-RPT Stop attackers stripping TLS from email sent to your domain. Publish an MTA-STS policy in testing mode, collect TLS-RPT reports, then enforce.