From p=none to p=reject: A Safe DMARC Rollout That Doesn't Break Your Email

A DMARC record with p=none satisfies the Gmail and Yahoo bulk sender requirement and does nothing else: it tells receivers to report, not to act. Domains stay there for years because moving to enforcement feels risky - and it is, if you skip the step in between where you find out who else is sending as you.

Step 1: publish p=none with reporting turned on

Add a rua= address so receivers send you aggregate reports. Without it you're flying blind, because the whole point of this phase is discovery. Reports are XML and unreadable at any scale, so route them into a DMARC report processor or at minimum a dedicated mailbox you can parse.

Step 2: inventory every sender

Give it a few weeks - long enough to see monthly and quarterly senders - and list every source that sends mail using your domain. The usual finds:

• Your main mailbox provider and any marketing platform you know about
• A billing, CRM, support-desk or HR tool someone connected years ago
• A website form plugin sending through a server that has no SPF or DKIM for your domain
• Forwarders and mailing lists that break SPF by design
• Actual spoofing that you'll be glad to shut off

Step 3: fix alignment for the legitimate ones

DMARC needs SPF or DKIM to pass and to align with the visible From domain. The most common failure for a legitimate service is passing DKIM for the vendor's own domain instead of yours. The fix is to set up custom DKIM signing with your domain for each third-party sender, and to add them to SPF only if they use a return-path on your domain. Keep the 10-DNS-lookup SPF limit in mind while you do it.

Step 4: move to quarantine, then reject

• Switch to p=quarantine once the reports show your known senders passing consistently. Failing mail now goes to spam instead of the inbox, which is a gentle way to catch what you missed
• Watch the reports and your own support inbox for a couple of weeks - missing invoices or form notifications are the tell
• Move to p=reject when nothing legitimate is failing. Failing mail is now refused outright
• Use the sp= tag if subdomains need a different policy from the parent domain

Not every domain needs to end at reject on day one, and a domain that never sends mail should get p=reject immediately - there is nothing legitimate to break. For a sending domain, the discipline is that you only tighten when the reports say it's safe, never on a calendar.

Generate a DMARC record with reporting addresses included

Confirm SPF, DKIM and DMARC together for your domain

p=none is where DMARC starts, not where it's finished. The value is in the reports you read while you're there.