Guides · Updated 2026-10-11

How to move DMARC from p=none to p=reject safely

1. Monitor (p=none). Publish DMARC with rua reporting. Collect at least 2 to 4 weeks of aggregate reports.
2. Inventory senders. List every source sending as your domain: mailbox provider, marketing, CRM, helpdesk, billing, website forms.
3. Fix each sender. Set up aligned DKIM (preferred) and/or SPF for each one. Retire anything you don't recognize, or investigate it as possible abuse.
4. Quarantine gradually. Move to p=quarantine. You can use pct (for example 25, then 50, then 100) to phase it in. Note that the newer DMARC specification draft replaces pct with a simpler test flag, so not every receiver honors partial percentages.
5. Reject. When reports show only legitimate, passing traffic, move to p=reject. Keep monitoring; new tools get added all the time.
6. Subdomains. Set sp=reject if subdomains don't send mail.

SenderLock automates steps 2 to 5 with alerts and one-click rollback. Join early access.

Sources

• RFC 7489: DMARC
• Google Workspace: Set up DMARC
• IETF DMARCbis draft

This guide is general information, not legal or professional advice. Provider screens change; always confirm the exact values shown in your own account.