DMARC roll-out from p=none to p=reject

DMARC tells receivers what to do with mail that claims to be from your domain but passes neither aligned SPF nor aligned DKIM, and where to send reports.

1. Start with p=none and reports

_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:[email protected]"

p=none changes nothing for delivery. It turns on daily aggregate reports from receivers, listing every source that sent mail as your domain and whether it passed.

If rua points to an address at another domain (a reporting service, for example), that domain must authorise it, or receivers will not send the reports:

example.com._report._dmarc.reports.example.net.  TXT  "v=DMARC1"

Reporting services publish this for their customers.

2. Fix every legitimate sender

A message passes DMARC when SPF passes for a domain that matches the From: domain, or a DKIM signature with d= matching it is valid. For each source in the reports that is really yours (your mail provider, newsletter tool, CRM, invoicing system):

• set up DKIM signing as your domain (see the DKIM guide), and
• add it to SPF if it uses your domain in the envelope sender (see the SPF guide).

Sources you do not recognise are what DMARC will block. Keep watching reports for a few weeks, so monthly senders show up too.

3. Move to p=quarantine

_dmarc.example.com.  TXT  "v=DMARC1; p=quarantine; rua=mailto:[email protected]"

Failing mail now goes to spam. Watch the reports and any complaints about missing mail before the last step.

4. Move to p=reject

_dmarc.example.com.  TXT  "v=DMARC1; p=reject; rua=mailto:[email protected]"

Failing mail is refused. This is the setting that stops others from sending as your exact domain, and a requirement for BIMI logos (see the BIMI guide).

Notes

• One DMARC record per name. It covers subdomains too unless they publish their own; sp= sets a different policy for subdomains.
• Domains that send no mail can go straight to p=reject.
• Check what is published: dig +short TXT _dmarc.example.com