At p=reject, receivers refuse mail that fails DMARC for your domain. That setting stays right only while your senders and DNS stay right. Keep watching new senders and record changes, cover your parked domains, add TLS reporting, and look at BIMI if you want your logo next to your mail.
Keep an eye on new senders
Businesses add tools all the time: a new booking system, a survey tool, a CRM that sends from your domain. At p=reject, a tool that isn't set up has its mail refused.
On Basic and up, MonitorBase e-mails you the day a new sending source shows up in the reports, and the alert in the app has Approve and Reject buttons. It also tells you if a sender you rejected starts passing, which usually means a DNS entry let it in.
Watch your records
DNS changes when a website moves, an agency tidies up, or a domain changes host. A DMARC record that is removed or softened back to p=none is easy to miss. MonitorBase re-checks SPF, DKIM, DMARC and MX daily on Basic and up, and alerts you when the record is removed or weakened, or when a check starts failing.
Blacklists, DNSSEC and domain expiry
The same daily check covers the things around your mail:
- Blacklists. An alert on a new blacklist hit.
- DNSSEC. An alert when it's broken or about to expire.
- Domain registration. A warning before your domain expires, and a note when it's renewed. If the registration lapses, mail and website stop with it.
Parked domains
Most companies own more domains than they send from: the old brand name, the .com next to the .dk, a campaign domain. They can be used to send mail in your name too. Styrelsen for Samfundssikkerhed recommends a reject policy on all of an organisation's domains.
A domain that never sends mail needs three records:
0 .
v=spf1 -all
v=DMARC1; p=reject; rua=mailto:[the report address MonitorBase shows you]
The first says the domain accepts no mail, the second that no server may send for it, the third tells receivers to refuse anything that tries. Basic includes unlimited parked domains, graded as parked domains, with an alert when one has a gap. More in the parked domain guide.
TLS-RPT and MTA-STS
DMARC is about mail sent in your name. TLS-RPT and MTA-STS are about mail sent to you: whether it travels encrypted.
- TLS-RPT asks sending servers to report when they couldn't connect to you securely.
- MTA-STS tells them to require encryption when they deliver to you.
v=TLSRPTv1; rua=mailto:[the TLS report address MonitorBase shows you]
The reporting card writes the exact record. MonitorBase reads the TLS reports, shows failures per reporter, and alerts you on Basic when they start. Start with TLS-RPT; add MTA-STS once the reports look clean. The TLS-RPT and MTA-STS explainer has the details.
Next goal: your logo in the inbox
A domain at p=quarantine or p=reject can publish a BIMI record, and some mail apps then show your logo next to your mail. It needs an SVG logo in a strict format and, for Gmail and Apple Mail, a certificate. Read What is BIMI to decide whether it's worth it for you. Once your logo is live, MonitorBase watches the certificate behind it on Basic and up.
Your checklist after p=reject
| What | Checked by MonitorBase | Alert (Basic and up) |
|---|---|---|
| New senders | From each day's reports | New sending source; rejected sender passing |
| DMARC, SPF, DKIM, MX | Daily | Record removed or weakened; check failing |
| Blacklists | Daily | New blacklist hit |
| DNSSEC | Daily | Broken or expiring |
| Domain registration | Daily | Expiring, expired, renewed |
| Parked domains | Daily | Parked-domain gaps |
| TLS reports | As they arrive | TLS-RPT failures |
| BIMI certificate | Daily | 30 and 7 days before expiry, expired, logo no longer matches, DMARC leaves enforcement |
Every Monday morning, Basic and up also gets the weekly report: the last 7 days per domain and one next action. On a personal domain on Free, the same checks run weekly and show in your dashboard, without alert e-mails.
Sources
- Styrelsen for Samfundssikkerhed (formerly CFCS), "Vejledning om phishing", 7 Oct 2022, samsik.dk: recommends a DMARC reject policy on all of an organisation's domains.
- MonitorBase checks and alerts: as in the app (13 Nov 2026).