Moving DMARC to p=reject: the checks before each step

Your domain has sat at p=none for months, the reports look fine, and you're still nervous about p=reject. I run the checks below before every step. This page also shows the change each step makes to the record, and how to roll back when a step blocks mail you wanted delivered.

Go to p=reject only when every check below passes against the last four weeks of aggregate reports. If you can't answer one of them, stay where you are for another week.

The checks

1. You can name every source above 1% of your volume, and each one aligns. Its mail passes DMARC on SPF or DKIM with the domain matching. How alignment works covers the matching part.
2. Aligned mail is above 98% of volume for two weeks running. For the step to reject, it needs to be above 99%. Take the number from the reports. A checker reads your record and can't see your mail.
3. DKIM carries most of the passes. At least four in five passing messages pass on aligned DKIM. SPF fails the moment a message is forwarded and DKIM survives it, so a domain passing on SPF alone is far more likely to lose mail at enforcement than its pass rate shows.
4. SPF is at eight lookups or fewer. The limit is ten. At nine, a new include can take the record past ten, and a sender that receivers need an eleventh lookup to find fails SPF. The SPF 10-lookup guide has the count and the fix.
5. Your monthly senders have run inside the window. Think of invoicing, payroll and the quarterly statement. You need at least four weeks of reports to catch a monthly sender once.
6. Reports are still arriving. If Google or Microsoft sent no report for a week, you're missing evidence. Don't count a quiet week as a pass.

Reading an aggregate report shows where each of these numbers sits in the XML. If you have never opened one, start there and come back.

Step 1: p=none to p=quarantine

Before you publish it, drop the TTL on the _dmarc record to 300 seconds. The TTL is how long a receiver caches your record, so it is also how long a rollback takes to reach them. At five minutes, you can roll back from your phone and see it take effect. At a day, you can't.

Then change none to quarantine and add pct=25 and t=y. Gmail, Outlook and Yahoo apply pct and ignore t=y. Receivers that follow RFC 9989 read t=y instead and apply the policy one level down, so p=quarantine acts as p=none.

Change nothing else, and leave sp= alone in this step. If you move the subdomain policy at the same time, more can break, and you won't know which change caused it. If the record has sp=quarantine, leave pct and t=y out, because both tags loosen the subdomain policy too.

After three days of reports with none of your own mail failing, raise pct to 50. After three more, remove pct and t=y:

At quarantine, a failing message goes to the recipient's spam folder. That's how you find out about a sender you missed. Someone at a partner says your invoice went to junk, and the message is still there to prove it. Watch the helpdesk as closely as the reports for two weeks after you remove pct and t=y.

Step 2: p=quarantine to p=reject

Run the checks again with the tighter pass rate. Then change quarantine to reject and add pct=25 and t=y. If the record has sp=quarantine, leave out pct and t=y. Raise pct to 50 after three days, and remove pct and t=y after three more:

If your domain shows a BIMI logo, the logo disappears while pct is under 100.

Once pct and t=y are gone, receivers refuse a failing message during delivery. The sending server gets a 550 5.7.1 bounce, and you get nothing. Keep rua= for as long as the domain exists, because the reports are the only way you'll see those failures.

Rolling back

A rollback stops receivers refusing new mail. Mail they already rejected stays rejected. Put the previous record back, and with a 300 second TTL every receiver is reading the old policy within five minutes. Rejected mail is gone. The sender has a bounce, and the only remedy is asking them to resend. Quarantined mail is in a spam folder, and the recipient can move it back to the inbox.

Roll back when the reports show a sender you've marked as your own failing more often after the step. Fix that sender at p=none or p=quarantine, wait for two clean weeks, and take the step again. Rolling back is a normal part of the process. Leaving a domain at quarantine for a year out of caution is worse. It has taken on the delivery risk, and spoofed mail still reaches spam folders.

By hand and with DomainCanary

By hand, you keep a spreadsheet with one row per sender and a column for each check, and fill it in every Monday from the week's reports. Cloudflare's free DMARC Management parses the reports for you if your DNS is there, and it covers a single domain on Cloudflare well.

With guided enforcement on the paid plans, we run these checks against your reports every day, work out how many messages the next step could cost you, and mail you the proposal with the evidence. You approve it from a link in the mail. For three days after we publish it, we read the reports. If a sender you've marked as yours starts failing, we move the record back and email you what happened. Hosted DMARC is how we publish and revert the record. You point _dmarc at us once, and every step takes effect within a quarter hour.