Getting to p=reject
without deleting your own mail.
A DMARC record at p=none protects nobody — it only reports. A DMARC record at p=reject protects your domain and, if you got there too fast, throws away real invoices, password resets and order confirmations. The gap between them is a process, not a setting.
The three policies, and what each one does to a failing message
| Policy | What the receiver does | Protects you? |
|---|---|---|
p=none | Nothing. Delivers as normal, sends you a report. | No — monitoring only |
p=quarantine | Routes the message to spam. | Partially |
p=reject | Refuses it at SMTP. It never reaches any folder. | Yes |
The uncomfortable implication: a domain sitting at p=none is publishing a record that says
"I am doing DMARC" while permitting anyone to spoof it. It is extremely common — an IT team publishes
p=none, the compliance box gets ticked, and it stays there for a year.
Stage 1 — p=none, and actually read the reports
Publish the record with a reporting address:
_dmarc.yourbrand.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@yourbrand.com; fo=1"Now wait, and do the work: receivers send daily XML summaries of every source sending as your domain. You are looking for a complete inventory of legitimate senders — the ESP, the CRM, the helpdesk, the invoicing system, the notification service someone wired up years ago — and whether each aligns.
Sit here at least two weeks, and longer if you bill monthly or quarterly: a system that only sends on the first of the month will not appear in a fortnight's reports, and that is exactly the system you do not want to discover by rejecting its output.
The mistake that costs real money
Going to p=reject before the inventory is complete. The mail that disappears is not spam —
it is your invoices, your password resets and your order confirmations, and it disappears silently,
because a rejected message never reaches a spam folder anyone can check.
Stage 2 — fix alignment, then quarantine
Work through the inventory and get each sender to sign with your domain. That is the alignment problem, and it is where most of the effort goes. Remember you only need one of SPF or DKIM to align — prefer DKIM, because it survives forwarding.
Before moving on, your reports should show at least 95% of legitimate volume passing, sustained for about a month. Not a good day. A month.
Then move to quarantine and watch for a week or two:
"v=DMARC1; p=quarantine; rua=mailto:dmarc@yourbrand.com; fo=1"Quarantine is the safe rehearsal: anything you missed lands in spam, where a human can still find it and tell you. That complaint is the point of this stage.
Stage 3 — reject, gradually
You do not have to jump. The pct= tag applies your policy to a percentage of failing mail:
"v=DMARC1; p=reject; pct=25; rua=mailto:dmarc@yourbrand.com"Start at 25, watch the reports, then 50, 75, and finally drop pct= entirely for 100%. If
something breaks at 25% you have lost a quarter of one sender's mail rather than all of it, and the reports
tell you which sender.
What you get at the end
Nobody can send mail that appears to come from your domain. Your legitimate mail is authenticated, aligned and trusted, which is a deliverability benefit in its own right — and you are compliant with the bulk-sender requirements that Gmail, Yahoo and Microsoft now enforce with permanent rejections rather than spam-foldering.
The subdomain detail nobody mentions
sp= sets the policy for subdomains, and it defaults to whatever p= is. That
matters in both directions.
- If you go to
p=rejectand something legitimate sends frommail.yourbrand.comornotifications.yourbrand.com, it is now rejected too. - Conversely, leaving subdomains permissive is a real hole: spoofing
billing.yourbrand.comis nearly as convincing as spoofing the root, and attackers know it.
The usual answer is to enforce on both and give any legitimate subdomain sender its own aligned DKIM — but decide it deliberately rather than inheriting it by accident.
We will run the rollout, or check the one you started
Most domains we look at are stuck at p=none with nobody reading the reports. Send us your domain and we will tell you what stage you are really at and what is blocking the next one.
Book a call →