DMARC Policy Progression: From None to Reject
Moving from p=none to p=reject is a journey, not a destination. This guide walks you through each stage of DMARC policy progression, helping you protect your domain without disrupting legitimate email delivery.
Why Start with p=none
When implementing DMARC for the first time, starting with p=none is essential. This monitoring-only mode lets you gather data about who is sending email on behalf of your domain without affecting mail delivery.
Identify every service sending email as your domain - marketing platforms, CRMs, ticketing systems, and more.
See which senders are failing SPF or DKIM checks so you can fix them before enforcement.
With p=none, receiving servers only report - they don't take action on failing emails.
v=DMARC1; p=none; rua=mailto:dmarc@example.comMonitoring Phase: Analyzing Reports
Once your p=none policy is in place, you'll start receiving aggregate reports (via the rua address) from email providers. These XML reports contain valuable data about authentication results.
Setting Up Report Collection
Configure both aggregate (rua) and forensic (ruf) reporting for maximum visibility:
v=DMARC1; p=none; rua=mailto:dmarc-aggregate@example.com; ruf=mailto:dmarc-forensic@example.com; fo=1Tip: Use a DMARC report analyzer service or tool to parse the XML reports into readable dashboards. Manually reading XML is tedious and error-prone.
What to Look For
- Legitimate senders failing authentication - These need SPF/DKIM fixes before enforcement
- Unknown sending sources - Investigate whether these are authorized or malicious
- Volume patterns - Understand your typical sending volume to spot anomalies
- Alignment failures - Check if the From domain aligns with SPF/DKIM domains
Moving to Quarantine: Gradual Rollout
After monitoring shows that your legitimate senders are properly authenticated, it's time to move to p=quarantine. The key is using the pct= tag for a gradual rollout.
Using pct= for Safe Progression
The pct= tag specifies what percentage of failing messages should have the policy applied. Start low and increase over time:
v=DMARC1; p=quarantine; pct=10; rua=mailto:dmarc@example.comv=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@example.comv=DMARC1; p=quarantine; pct=50; rua=mailto:dmarc@example.comv=DMARC1; p=quarantine; rua=mailto:dmarc@example.comImportant: When pct= is omitted, it defaults to 100%. Always include pct= explicitly during rollout phases to avoid accidentally enforcing on all traffic.
Full Enforcement: Moving to p=reject
The final step is moving from quarantine to reject. At p=reject, receiving servers will refuse to deliver messages that fail DMARC authentication entirely.
When You're Ready for Reject
All legitimate senders consistently pass DMARC checks
p=quarantine at 100% shows no delivery issues
You've accounted for forwarding scenarios and mailing lists
Like quarantine, use pct= to gradually increase reject enforcement:
v=DMARC1; p=reject; pct=25; rua=mailto:dmarc@example.comv=DMARC1; p=reject; pct=50; rua=mailto:dmarc@example.comv=DMARC1; p=reject; rua=mailto:dmarc@example.comWhat to Expect After p=reject
- Spoofed emails from your domain will be rejected outright
- You may see an initial spike in bounce reports as bad actors are blocked
- Forwarded emails may have delivery issues (consider ARC)
- You'll qualify for BIMI implementation
Realistic Timeline
DMARC progression isn't a race. Here's a realistic timeline for most organizations:
Deploy monitoring-only policy. Collect aggregate reports and build a complete picture of your email ecosystem.
Configure SPF and DKIM for all identified senders. Update DNS records and verify alignment.
Move to quarantine starting at 10%, increasing to 100% over several weeks while monitoring reports.
After stable quarantine, move to reject. Start at 25% and increase to full enforcement.
Your domain is fully protected. Continue monitoring reports for new senders or issues.
Note: Large organizations with many email senders may need 6-12 months. Smaller organizations with fewer senders can often complete in 8-12 weeks.
Common Pitfalls
Marketing tools, CRMs, support desks, and other services often send as your domain. Moving to enforcement before configuring these will break their delivery. Audit all services that send email on your behalf.
Jumping straight to p=reject without monitoring causes legitimate email to bounce. Always spend adequate time in monitoring mode and use pct= for gradual rollout.
Email forwarding breaks DKIM and SPF alignment. Mailing lists and forwarding rules can cause legitimate emails to fail. Consider implementing ARC (Authenticated Received Chain) support.
DMARC isn't "set and forget." New senders, configuration changes, and new threats require ongoing monitoring. Keep reviewing your aggregate reports regularly.
Your DMARC policy may not apply to subdomains by default. Use sp= to set a subdomain policy, or implement separate DMARC records for critical subdomains.
Summary
- 1.Start with p=none to discover all senders and authentication gaps without affecting delivery
- 2.Analyze DMARC reports and fix SPF/DKIM for all legitimate senders
- 3.Move to p=quarantine using pct= for gradual rollout (10% to 100%)
- 4.Progress to p=reject gradually after stable quarantine enforcement
- 5.Continue monitoring reports even after full enforcement
Check Your DMARC Policy
Use our scanner to analyze your current DMARC configuration and get recommendations for improvement.
Scan Your Domain