p=none is where everyone should start, and where far too many domains stay. It asks receivers for reports and changes nothing about delivery, so anyone can still send mail claiming to be you. Getting to p=reject is mostly patience: find every service that sends as you, make each one pass, then tighten.
The route
- Publish
p=nonewith a report address.v=DMARC1; p=none; rua=mailto:dmarc-reports@yourcompany.com. Withoutruayou're flying blind. - Collect two to four weeks of reports. Monthly senders (invoicing, payroll, a quarterly newsletter) only show up if you wait long enough.
- List every source that sends as you. For each one, decide whether it's yours. Reading DMARC reports shows how.
- Make each legitimate source pass. Usually that means turning on DKIM signing with your domain in the tool's settings. Aligned DKIM beats SPF because it survives forwarding.
- Move to
p=quarantine. Failing mail goes to spam instead of the inbox. Watch the reports, and your own inbox, for a couple of weeks. - Move to
p=reject. Failing mail is refused outright.
How to know you're ready
Tighten when, over a full month of reports, every source you recognise passes DMARC and everything that fails is either spoofing or forwarding. Forwarding failures (mailing lists, old university addresses, some security gateways) are normal and nothing you can fix from your side. DKIM usually survives them.
pct, t and RFC 9989
Older guides say to ramp up with pct=10, pct=25 and so on. The 2026 revision of DMARC (RFC 9989, which replaces RFC 7489) removed pct and added a simpler testing flag, t=y, asking receivers to apply the policy one step softer. Receivers still read older records, so an existing pct won't break anything. Just don't build a rollout plan around it. Going from none to quarantine once the reports are clean is the reliable path.
Subdomains
Subdomains inherit the parent's policy unless you set sp=. If one subdomain sends mail that isn't ready, give it its own _dmarc record at p=none rather than holding back the whole domain.
Questions people ask
Will p=quarantine hurt my own mail?
Only mail that fails DMARC, which is why you read the reports first. If every legitimate source passes, nothing changes for you.
Do I need p=reject?
Gmail, Yahoo and Outlook.com accept p=none for their sender rules. Enforcement is what actually stops people spoofing your domain, and BIMI needs quarantine or reject.
How long does the whole route take?
Six to ten weeks is typical for a small business: a month of reports, a week or two fixing sources, two weeks at quarantine.
Related guides
- How to read a DMARC aggregate report Tell your own services from spoofing, and fix each kind of failure.
- How to find your DKIM selector Read it from a message header in a minute, then check the key.
- BIMI: getting your logo next to your emails What it takes to get your logo shown, and when it's worth it.
DNS only shows part of the picture. If mail is still landing in spam with every record right, the deliverability audit looks at the rest: blocklists, reputation, bounces, content and the sending setup.