How long should I stay at p=none?

Long enough to see a full cycle of your organisation's sending, which usually means two to four weeks and sometimes longer. Monthly processes — invoicing runs, payroll notifications, quarterly reports — will not appear in a one-week sample. The goal is not to wait a fixed period but to reach the point where you recognise every sender in your reports.

What is the difference between quarantine and reject?

Quarantine tells receivers to treat failing mail as suspicious, which usually means the spam folder. Reject tells them to refuse it outright, so it never arrives at all. Quarantine is the safer intermediate step because a mistake is recoverable — the recipient can find the message in spam — whereas under reject a misconfigured legitimate sender simply fails silently.

Do I need a DMARC report analyser?

For a small domain with two or three senders you can read the XML directly, though it is tedious. Beyond that a report analyser is worth it: aggregate reports arrive as compressed XML from every receiving provider, and correlating them by hand across weeks is impractical. Several free tiers exist that are adequate for a single domain.

Will p=reject stop all spoofing of my domain?

It stops direct spoofing of your exact domain, which is the most common form and worth eliminating. It does not stop lookalike domains — someone registering a similar name and sending from that is unaffected by your DMARC policy, because it is technically their domain and they can authenticate it properly.

DMARC Policy Rollout: p=none to p=reject Guide

DMARC is the only part of email authentication that tells receiving servers what to do when something fails. SPF and DKIM produce results; DMARC turns those results into a policy. It is also the part most likely to break your own mail if you enable it carelessly.

The three policies

Policy	Receiver behaviour on failure	Risk to you
p=none	Deliver normally, send reports	None
p=quarantine	Treat as suspicious — usually spam folder	Recoverable
p=reject	Refuse the message outright	Silent loss

Only p=reject genuinely prevents someone spoofing your domain, so it is the destination. The path there is what matters.

Stage 1 — publish p=none

Start here, always:

_dmarc.yourdomain.com    TXT    v=DMARC1; p=none; rua=mailto:[email protected]; fo=1

This instructs receivers to change nothing about how they handle your mail, but to send you aggregate reports. It is entirely risk-free and it is the only way to see what is actually sending as your domain.

The rua address is where reports go. Use a dedicated mailbox — they arrive as compressed XML from every provider that receives your mail, and there will be more than you expect.

Stage 2 — read the reports and find your senders

This is the stage that takes real time, and skipping it is what causes the failures.

Aggregate reports show, per sending source, how many messages claimed to be from your domain and whether they passed SPF, DKIM and alignment. Almost every organisation running this for the first time finds senders nobody remembered:

An invoicing or accounting system emailing customers directly.
A helpdesk or ticketing platform sending as your support address.
A CRM or marketing tool a colleague signed up for years ago.
A recruitment or HR platform mailing candidates.
Monitoring and alerting systems on your own infrastructure.

For each legitimate sender, configure proper authentication — usually adding their SPF include and publishing their DKIM key at a selector you control. For each illegitimate one, you now have evidence of spoofing that your eventual policy will stop.

Stay here until you recognise everything in the reports. Two to four weeks minimum, and longer if you have monthly or quarterly processes that will not appear in a short sample.

Stage 3 — move to quarantine

Once your known senders authenticate cleanly:

v=DMARC1; p=quarantine; rua=mailto:[email protected]; fo=1

You can ease into this with the pct tag, applying the policy to a fraction of mail — pct=25 to start, raising it as confidence grows. Watch reports for a further two weeks. Anything legitimate that you missed will now land in spam folders, which is visible and recoverable rather than silent.

Stage 4 — move to reject

v=DMARC1; p=reject; rua=mailto:[email protected]; fo=1

Now nobody can send as your exact domain without authenticating. Keep the reporting address in place permanently — new sending systems get adopted, and you want to see them fail in reports before someone reports that their mail is not arriving.

The subdomain question

By default a DMARC policy applies to subdomains too. The sp tag sets a different policy for them, which is useful during rollout — you can enforce reject on your primary domain while a marketing subdomain is still being sorted out:

v=DMARC1; p=reject; sp=quarantine; rua=mailto:[email protected]

This pairs naturally with the practice of separating marketing onto its own subdomain, covered in our guide to transactional versus marketing mail.

What DMARC does not do

Worth being clear, because it is oversold. DMARC stops someone sending mail that claims to be from your exact domain. It does nothing about a lookalike domain — a registration one character different, or with a different suffix — because the attacker owns that domain and can authenticate it perfectly well. It also does not improve your reputation on its own; it removes an avoidable failure and satisfies a bulk sender requirement, which is worthwhile but different.

You can check your current policy in a few seconds with our free authentication checker.

Rolling Out DMARC: Getting from p=none to p=reject Without Breaking Your Mail

Quick Summary (AI Answer Box)