Skip to content
Back to Blog
DMARC.WS Team··10 min read

How to Move from DMARC p=none to p=reject Safely

DMARCPolicyBest PracticesTutorial

Why p=none Is Only the Beginning

Publishing a DMARC record with p=none is a great first step — it enables monitoring without affecting mail delivery. But p=none doesn't actually protect your domain. Spoofed emails still reach inboxes. Your brand is still vulnerable.

The goal is p=reject, which tells receivers to discard unauthenticated messages entirely. The journey from none to reject is where most organizations get stuck.

This guide walks you through the process safely, step by step.

The DMARC Policy Progression

Policy Effect Use Case
p=none Monitor only, no action on failures Initial deployment, data gathering
p=quarantine Failed messages go to spam/junk Intermediate enforcement
p=reject Failed messages are discarded Full protection

The pct (percentage) tag lets you apply the policy to only a fraction of your mail, making the transition gradual and reversible.

Phase 1: Monitoring (p=none)

Set Up Your DMARC Record

If you haven't already:

v=DMARC1; p=none; rua=mailto:dmarc@example.com; ruf=mailto:dmarc-forensic@example.com

This tells receivers to send aggregate reports (RUA) and forensic reports (RUF) to your chosen addresses without taking any action on failures.

Collect Data for 2–4 Weeks

You need enough data to identify every legitimate email source. Look for:

  • All passing sources: These are your authorized senders (Google Workspace, SendGrid, Mailchimp, etc.)
  • Failing sources with high volume: These are likely legitimate services you haven't configured properly
  • Failing sources with low volume: Could be forwarding, mailing lists, or actual spoofing attempts

Fix Authentication for Every Legitimate Source

For each legitimate sender that's failing:

  1. Configure SPF: Add their sending IPs or include mechanism to your SPF record
  2. Configure DKIM: Set up DKIM signing and publish the public key in your DNS
  3. Verify alignment: Make sure the SPF domain or DKIM signing domain aligns with your From address

Common sources that need attention:

  • Marketing platforms (Mailchimp, HubSpot, Sendgrid)
  • Transactional email (Postmark, SES, Mandrill)
  • CRM systems (Salesforce, HubSpot)
  • Helpdesk tools (Zendesk, Freshdesk)
  • Internal applications sending automated emails
  • Legacy on-premise mail servers

Target: 95%+ Pass Rate

Before moving to enforcement, you want to see a consistent pass rate above 95%. The remaining failures should be from sources you've identified as either spoofing, forwarding (which you can't control), or services you no longer use.

Phase 2: Soft Enforcement (p=quarantine, pct=10)

Once your pass rate is stable above 95%, start enforcement gradually:

v=DMARC1; p=quarantine; pct=10; rua=mailto:dmarc@example.com

This applies quarantine to only 10% of failing messages. The other 90% are still treated as p=none.

Monitor for 1–2 Weeks

Watch your DMARC reports closely. If legitimate mail is being quarantined:

  1. Identify the failing source
  2. Fix the authentication configuration
  3. Keep the same policy until the issue is resolved

Ramp Up Gradually

If no legitimate mail is affected:

pct=25 → pct=50 → pct=75 → pct=100

Spend at least one week at each level. There's no rush — the cost of breaking legitimate email is much higher than the cost of taking an extra week.

Phase 3: Full Quarantine (p=quarantine, pct=100)

v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com

(When pct is omitted, it defaults to 100.)

At this stage, all failing messages go to spam. This is strong protection, but users can still find legitimate messages in their junk folder if something goes wrong.

Hold for 2–4 Weeks

This is your safety net period. If a misconfigured service starts failing, messages land in spam rather than being silently discarded.

Phase 4: Reject (p=reject, pct=10)

Now move to reject, again using pct to ramp up gradually:

v=DMARC1; p=reject; pct=10; rua=mailto:dmarc@example.com

Ramp Up to Full Reject

Same drill — increase pct over several weeks:

pct=10 → pct=25 → pct=50 → pct=100

Phase 5: Full Protection (p=reject)

v=DMARC1; p=reject; rua=mailto:dmarc@example.com; ruf=mailto:dmarc-forensic@example.com

Congratulations — your domain is fully protected. Unauthenticated messages are rejected outright.

The Complete Timeline

Week Action Record
1–4 Monitor, fix auth p=none
5–6 Soft quarantine ramp p=quarantine; pct=10→50
7–8 Full quarantine p=quarantine
9–10 Reject ramp p=reject; pct=10→50
11–12 Full reject p=reject

This is a conservative timeline. Some organizations can move faster. The key is having data — don't advance until you're confident your legitimate sources are authenticated.

Common Pitfalls

Moving Too Fast

Jumping from p=none to p=reject in a single step is the most common mistake. If you miss a legitimate sender, their email gets silently dropped. Your sales team's CRM emails vanish. Support tickets disappear.

Forgetting About Subdomains

DMARC's sp (subdomain policy) tag controls what happens to subdomains. If you set p=reject on your main domain but forget about sp, subdomains may default to the parent policy — or not, depending on the receiver's implementation.

Best practice: explicitly set sp=reject once your main domain is enforced, or set up individual DMARC records for subdomains that send mail.

Email Forwarding

Forwarded emails naturally fail SPF (the forwarding server's IP isn't in your SPF record). DKIM usually survives forwarding unless the message body is modified. ARC (Authenticated Received Chain) helps receivers trust forwarded messages, but adoption is still growing.

You may always see some failures from forwarding. These are expected and shouldn't block your enforcement timeline.

Third-Party Services Added After Enforcement

When you add a new email sending service after reaching p=reject, configure SPF and DKIM before sending the first message. Otherwise, every email from that service will be rejected.

Monitoring After Enforcement

Reaching p=reject isn't the end. Continue monitoring:

  1. Review DMARC reports weekly: Watch for new failing sources that could be legitimate services you've added
  2. Track pass rates: A sudden drop indicates a configuration change somewhere
  3. Monitor SPF record changes: Third-party providers update their SPF includes; if their IPs change, your flattened record may need updating
  4. Audit new services: Before onboarding any new email tool, verify it supports SPF and DKIM for your domain

Summary

The path from p=none to p=reject is straightforward but requires patience:

  1. Monitor and identify all legitimate senders
  2. Fix SPF and DKIM for every source
  3. Enforce gradually using quarantine + pct
  4. Advance to reject with pct ramping
  5. Monitor continuously after enforcement

The entire process typically takes 8–12 weeks. The result is a domain that can't be spoofed — protecting your customers, your reputation, and your deliverability.