Move DMARC from p=none to p=reject safely

Why not jump straight to reject

With p=none receivers report on mail but still deliver it. With p=reject mail that fails DMARC is refused. If a service you forgot about sends as your domain, jumping to reject blocks it. The safe path is to learn who sends first.

Steps

  1. Publish monitor mode with a reporting address you read: 
    v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com
  2. Wait two to four weeks and read the aggregate reports. List every source that sends as your domain: your mailbox provider, newsletter and CRM tools, invoicing and helpdesk systems.
  3. For each legitimate source that fails, fix it: publish its DKIM record under your own domain and include it in SPF where appropriate, so its mail passes with alignment.
  4. Move to quarantine gradually using the pct tag, for example p=quarantine; pct=10, then 50, then 100, checking reports between steps.
  5. When reports show only unwanted sources failing, move to p=reject. Keep the rua address so you keep seeing reports.

Subdomains

The sp tag sets a separate policy for subdomains. If you do not set it, subdomains follow p.

Rollback

Changing the record back to the previous value restores the previous behaviour once DNS caches expire.

Check your domain

The free checker reads your live DNS and shows what is missing. The $29 Email Fix Pack writes the fix for your email provider and DNS host, with a rollback plan.

Check your domain free

Sources

More email delivery fixes