How to Deploy DMARC: From p=none to Full Enforcement

DMARC lets you tell receiving servers what to do with email that fails SPF and DKIM checks — and the safe way to deploy it is gradually, starting in monitor-only mode and tightening once you trust your reports. Rushing straight to enforcement risks blocking your own legitimate mail.

What DMARC adds

DMARC builds on SPF and DKIM with two things they lack: a policy (what to do on failure) and alignment (the authenticated domain must match the visible "From"). It also sends you aggregate reports of who is sending as your domain — the crucial visibility that makes safe rollout possible.

The DMARC record

DMARC is a TXT record at _dmarc.yourdomain.com. Its key tags:

• p — the policy: none, quarantine or reject.
• rua — the address to receive aggregate reports.
• pct — the percentage of mail the policy applies to (for gradual rollout).
• sp — a separate policy for subdomains.

The rollout, step by step

1. Start at p=none — monitor only. Nothing is blocked; you simply collect reports via rua. Let this run until you see the full picture of who sends as your domain.
2. Fix what the reports reveal — bring every legitimate sender into SPF and DKIM with proper alignment. This is where you catch a forgotten newsletter service or app.
3. Move to p=quarantine — failing mail goes to spam rather than being rejected. Optionally use pct to apply it to a fraction first, then ramp to 100%.
4. Move to p=reject — failing mail is refused outright. This is full protection against spoofing your domain.

Why the gradual path matters

Jumping to reject before your reports are clean can block real mail from a sender you forgot to authorise. Monitoring first is what makes enforcement safe. Good DMARC is a major fix for deliverability and spoofing.

Frequently asked questions

What does p=none actually do?

Nothing to your mail flow — it only enables reporting. It is the monitoring stage where you learn who sends as your domain, so you can authorise legitimate senders before you start enforcing.

How long should I stay at p=none?

Until your aggregate reports show all legitimate mail passing with alignment — often a few weeks. The goal is confidence that moving to quarantine or reject will not block anything real.

What's the difference between quarantine and reject?

Quarantine sends failing mail to spam; reject refuses it outright. Quarantine is a cautious intermediate step, while reject is full enforcement that stops spoofed mail reaching inboxes at all.