Moving DMARC from p=none to p=reject without losing mail
A large share of published DMARC records are still at p=none — collecting reports, preventing nothing. The other failure mode is the opposite: jumping straight to reject and bouncing your own newsletter. Here is the staged path between the two.
Stage 0–1: monitor, then fix alignment (2–6 weeks)
Publish p=none with rua= and read the reports weekly. Your task: every legitimate source must reach DMARC pass. Google Workspace and Microsoft 365 need DKIM enabled in their admin consoles; newsletter and transactional tools need their custom-domain/DKIM setup completed so they sign as YOUR domain. A source that passes raw SPF but stays unaligned (very common with ESPs using their own bounce domain) needs DKIM alignment — that is the fix nine times out of ten.
You are ready to move when reports show ≥98–99% of legitimate volume passing for two consecutive weeks. The remainder is usually forwarding, which enforcement handles acceptably (DKIM survives most forwarders).
Stage 2–3: quarantine, then reject
Switch to p=quarantine — failing mail goes to spam, a recoverable failure mode. If volume is large or stakes are high, phase in with pct=25 → 50 → 100 over a few weeks. Keep reading reports: what you are looking for now is any legitimate source you missed showing up with disposition=quarantine.
After 2–4 clean weeks at quarantine/pct=100, set p=reject. Consider sp= explicitly for subdomains, and remember the rollback is instant: DMARC is a DNS record, and downgrading to quarantine takes effect within the TTL. That rollback safety is exactly why there is no excuse to park at p=none forever.
MonitorBase automates the watching: the pass rate per source, a recommendation for the next policy step once there is enough report data, and, from the Basic plan, alerts when compliance drops, a new source appears or anyone weakens the policy without you.
Free tools that help
- XML-to-Human Converter: Paste or upload a DMARC aggregate report and read it as a table with named sources.
- DMARC Inspector: Parse and grade your DMARC policy, reporting addresses and alignment settings.