DMARC Step by Step: From p=none to p=reject Without Breaking Your Email

DMARC is the record that tells inbox providers what to do with email that pretends to come from your domain. Most businesses publish a DMARC record with p=none to satisfy Gmail and Microsoft, and then never touch it again. That is a missed opportunity: p=none only monitors. It does not stop anyone from sending phishing emails in your name.

In this guide we walk through the safe path from monitoring to full protection, without accidentally blocking your own invoices or newsletters.

A quick refresher: the three DMARC policies

• p=none: report only. Nothing is blocked. This is where everyone should start.
• p=quarantine: mail that fails authentication is sent to spam.
• p=reject: mail that fails is refused outright. This is full protection against spoofing.

A typical starting record looks like this:

_dmarc.yourcompany.com  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@yourcompany.com"

The rua address receives daily aggregate reports from Gmail, Microsoft, Yahoo and others, showing every server that sent mail using your domain.

Step 1: Collect reports for 2 to 4 weeks

DMARC reports arrive as XML files that are hard to read on their own, so use a free or low-cost DMARC report viewer. What you are looking for is simple: which services send email as your domain, and do they pass SPF or DKIM with alignment?

You will usually find a few surprises: an old newsletter tool, a website contact form, an invoicing system, a CRM, or a scheduling app that sends confirmations.

Step 2: Fix every legitimate sender

For each service you recognise and still use:

• Turn on DKIM signing with your own domain (most platforms give you two or three DNS records to add).
• Add it to your SPF record if it sends from its own servers, while keeping SPF under the 10-lookup limit.
• Make sure the domain in the visible “From” address matches the domain that is signed or authorised. That is what “alignment” means.

Anything you do not recognise is either a forgotten tool or someone spoofing you. Both are good to know.

Step 3: Move to quarantine, gradually

Once your reports show that legitimate mail passes consistently, switch to quarantine. You can roll it out gradually with the pct tag:

v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@yourcompany.com

Increase to 50 and then 100 over a couple of weeks while watching the reports. If a real service starts failing, you will see it before customers complain.

Step 4: Go to reject

When quarantine at 100% has been stable for a few weeks, publish p=reject. From that point, anyone trying to send fake invoices or “urgent payment” emails from your domain is blocked at the door by every major mailbox provider.

Bonus: protect domains that never send email

Parked or unused domains are popular with spammers. Protect them with a strict policy and an empty SPF record:

yourotherdomain.com         TXT  "v=spf1 -all"
_dmarc.yourotherdomain.com  TXT  "v=DMARC1; p=reject"

Why it is worth the effort

• Security: it stops criminals impersonating your business to your customers and suppliers.
• Deliverability: mailbox providers trust domains with enforced policies more.
• Brand: a p=quarantine or p=reject policy is a prerequisite for BIMI, which can show your logo next to your emails in supporting inboxes.

Want to see where your domain stands today? Run our free Email Deliverability Checker. If you would rather not deal with XML reports and DNS records, our support plans include a fully managed DMARC rollout. Talk to us.