generatepassword.eu

Moving DMARC from p=none to p=reject without losing mail

7 min read · Published · Password and DNS Toolbox

Short answer

Stay at p=none until your aggregate reports show every legitimate sender passing DMARC. Then switch to p=quarantine, watch the reports for a couple of weeks, and move to p=reject. Set sp= for subdomains deliberately, and expect some forwarded mail to rely on DKIM.

Key points

  • p=none only monitors; spoofed mail is still delivered.
  • Enforce only when reports show all legitimate sources passing with alignment.
  • RFC 9989 removed the pct tag; do not rely on percentage roll-outs.

Why p=none is not enough

With p=none receivers only report. Anyone can still send mail that claims to be from your domain, and it will be delivered. Enforcement (quarantine or reject) is what actually protects your customers and your brand. It is also a precondition for showing your logo with BIMI.

Read the aggregate reports

Group report rows by sending source (IP address and the provider behind it). For each source, check three things: does SPF pass with an aligned domain, does DKIM pass with an aligned domain, and is the source legitimate? Typical findings:

  • A known service fails — usually DKIM is not enabled or the SPF include is missing. Fix it at the service.
  • SPF passes but is not aligned — the service uses its own bounce domain. Enable DKIM with your domain; that gives alignment.
  • Forwarders and mailing lists — SPF fails because the forwarder resends the message. DKIM normally survives. This is expected.
  • Unknown sources failing both — often spoofing. That is exactly what enforcement will stop.

The migration steps

  1. p=none with rua= for two to six weeks, until all legitimate volume passes.
  2. p=quarantine. Failing mail goes to spam folders. Watch reports and user complaints for two weeks or more.
  3. p=reject. Failing mail is refused outright.

Check the record after every change with the DMARC checker.

Don't forget subdomains

Subdomains without their own DMARC record inherit your policy through sp= (default: the same as p). RFC 9989 adds np= for subdomains that do not exist at all — a good place to set reject early, because nobody should send from them.

What about pct=?

The original DMARC specification allowed pct= to apply the policy to a percentage of failing mail. RFC 9989 removed it, and receivers may ignore it. Plan your roll-out with the quarantine step instead of percentages.

Frequently asked questions

How long should I stay on p=none?

Until reports show all legitimate sending sources passing. For most organisations that is two to six weeks.

Will p=reject block forwarded mail?

Only forwarded mail that fails both SPF and DKIM. Most forwarding keeps DKIM intact.

Is quarantine enough?

It helps, but reject is stronger: spoofed mail never reaches the user at all.

Sources