How to move from p=none to p=reject without losing mail

The plan at a glance

In DMARC Dojo each stage has a belt: White belt is p=none, Orange belt is p=quarantine and Black belt is p=reject.

Step 1: Publish p=none with reporting

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

p=none asks receivers to take no action on failing mail, so nothing changes for delivery. What you gain is reporting: Gmail, Microsoft, Yahoo and other receivers send a daily XML summary of every IP that sent mail using your domain, and whether it passed. Leave alignment relaxed (the default) and don’t add sp= yet.

Wait at least two weeks, and ideally four, before drawing conclusions. Some senders only run monthly (invoices, payroll, newsletters), and a short window will miss them. Reports arrive as zipped XML, which is hard to read by hand: the DMARC report analyzer turns a file into a table, and how to read DMARC aggregate reports explains each field. The DMARC record generator builds the record if you don’t have one yet.

Step 2: Inventory every sender

Group the sources in your reports into three buckets:

• Legitimate: your mailbox provider (Google Workspace, Microsoft 365), marketing and transactional services, CRM, help desk, billing, HR, website forms, and on-premises systems such as printers or monitoring. Reverse DNS usually identifies the provider.
• Unknown: sources you can’t place. Ask around before deciding: a team may have signed up for a tool without telling IT. Search the IP’s owner and check whether volume is steady (a real service) or sporadic.
• Spoofing and forwarding: sources failing both SPF and DKIM from networks you don’t use are spoofing, which enforcement will block. Sources failing SPF but passing aligned DKIM are usually forwarders and are fine.

Write the list down with an owner for each legitimate sender. You’ll need it for the next step and every time someone adds a new tool.

Step 3: Fix alignment for each legitimate sender, DKIM first

For each legitimate sender that fails, set up DKIM signing with your own domain. DKIM aligns on its own and survives forwarding, while SPF breaks whenever mail is forwarded and often passes for the vendor’s bounce domain rather than yours. Add SPF includes only for senders that use a return path on your domain, and keep an eye on the 10-lookup limit.

The setup differs by provider: see the guides for Google Workspace, Microsoft 365, SendGrid, Mailchimp, HubSpot and Salesforce. If a source keeps failing, why DMARC fails maps each symptom to its cause.

What pass rate to aim for. Measure against legitimate mail only, not total volume (spoofing drags the total down). Before quarantine, aim for about 98% or more of legitimate volume passing, and no known sender failing across the board. The remainder is typically forwarding and mailing lists, which you can’t fix from your side. There is no official threshold; this is a practical margin that leaves room for the long tail.

Step 4: Move to p=quarantine

v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com

Quarantine asks receivers to treat failing mail as suspicious, which in practice usually means the spam folder. Mistakes are recoverable: recipients can still find the message.

Stepping up gradually: pct and the new t=y testing flag

The original DMARC specification (RFC 7489) has a pct= tag that applies the policy to only a percentage of failing mail, for example p=quarantine; pct=10. Google’s own rollout guidance suggests starting quarantine at a small percentage and increasing it. In May 2026 the IETF published the updated standard, often called DMARCbis, as RFC 9989 (with aggregate reporting in RFC 9990 and failure reporting in RFC 9991). It retires pct, noting that values other than 0 and 100 were applied inconsistently, and replaces it with a testing flag, t=y, which asks receivers to apply the policy one level below the one published (quarantine is treated as none, reject as quarantine).

In practice, receivers are moving to the new standard at different speeds, so percentage stepping may or may not be honored. The safer way to go gradually is by domain and by time: move to quarantine only when the reports say you’re ready, and use the quarantine stage itself as the trial run for reject. If you do publish pct, treat it as a hint, not a guarantee.

What to watch after the change

• The DMARC pass rate for each legitimate source in the next few days of reports. It should not drop.
• Complaints from colleagues or customers that a tool’s mail went to spam: usually a sender that was missed in step 2.
• Monthly or quarterly senders, which may only show up weeks after the change.

Stay at quarantine for two to four weeks, long enough to cover at least one monthly send cycle.

Step 5: Move to p=reject

v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com

At p=reject receivers are asked to refuse failing mail during the SMTP transaction, so spoofed mail never reaches the inbox or the spam folder. Legitimate mail that fails also bounces, and the sender gets a DMARC-related bounce message, which at least makes the problem visible. Move on when quarantine has run cleanly with no legitimate source failing.

How to roll back

If a legitimate sender breaks after a change, edit the record back one step (reject to quarantine, or quarantine to none), fix the sender, and try again. Receivers cache DNS for the record’s TTL, so a change takes effect within minutes to a few hours. A short TTL (for example 300 seconds) during the rollout makes both moving forward and backing out faster. With DMARC Dojo, the _dmarc record is a CNAME to a hosted record, so a policy change or rollback goes live in about a minute without touching DNS.

Step 6: Subdomains and parked domains

Subdomains without their own DMARC record use the organizational domain’s record, with sp= if it’s set and p= otherwise. Attackers look for gaps like sp=none, so once you’re at reject, either omit sp (subdomains inherit p=reject) or set sp=reject explicitly. A subdomain with its own sender can publish its own record at _dmarc.sub.example.com and go through the same stages.

Domains that never send mail (old brands, typo defenses, redirects) should be locked down completely. This “null” setup tells receivers that no mail from the domain is legitimate:

If the reporting address is on another domain, that domain must authorize it with a _report._dmarc record, as explained in the aggregate reports guide.

Step 7: Keep monitoring

Reaching p=reject is not the end. New tools get adopted, vendors rotate DKIM keys, and someone adds an SPF include that pushes you over 10 lookups. Keep rua in the record forever and review reports at least weekly: a new failing source that looks legitimate is almost always a new tool someone forgot to set up. DMARC Dojo sends a daily digest of action items while any domain is below Black belt and a weekly one after that.