From p=none to p=reject without losing a single e-mail
The safe path to an enforced DMARC policy: what to check at each step, how pct and sp work, how long to wait, and what to do when a legitimate service fails.
A DMARC record with p=none protects nothing. It asks providers to send you reports, which is useful, but tells them to deliver forged mail exactly as before. Most domains that publish DMARC stay at p=none for years, because nobody wants to be the person who blocked the invoices. This guide is the path out, in steps small enough that nothing breaks.
Before you start
You need two weeks of reports. If your record has no rua= address, add one now and wait: without reports you are tightening blind. Read them as described in Reading DMARC reports until every service you use passes with DKIM aligned to your domain.
Also check your SPF record: if it has more than ten DNS lookups it fails for everyone (permerror), and DMARC then relies on DKIM alone. The SPF checker counts them.
Step 1: quarantine a small share
v=DMARC1; p=quarantine; pct=10; rua=mailto:dmarc@yourdomain.compct=10 asks providers to apply the policy to 10% of failing messages and treat the rest as p=none. Failing mail now lands in spam, for one message in ten. Watch the reports and your support inbox for a week. If a customer says your invoices went to spam, the reports tell you which service sent them.
Step 2: quarantine everything
Raise pct to 25, 50, then 100, a week each, or straight to 100 if the reports show nothing of yours failing. Note that pct is honoured unevenly: some providers treat any value below 100 as 0 or as 100. It slows the change down; it is not a precise dial. (The DMARCbis revision of the standard replaces pct with a simpler testing flag, t=y; current providers still read pct.)
Step 3: reject
v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.comForged mail is now refused before it reaches anyone’s inbox. This is the setting that stops someone sending “please pay this new IBAN” from your address.
Subdomains: sp=
Without sp=, subdomains inherit p=. If you once set sp=none to protect a sending subdomain, remember to remove it, or attackers will simply use billing.yourdomain.com. Subdomains that never send mail need nothing more: an enforced policy on the parent covers them.
Domains that never send mail
Defensive registrations, old brand names, the .net you bought to protect the .com: go straight to p=reject there, with an empty SPF:
yourdomain.net. TXT "v=spf1 -all"
_dmarc.yourdomain.net. TXT "v=DMARC1; p=reject;"There is nothing to monitor, since nothing legitimate is sent.
When something legitimate fails
It happens: a new tool, a partner sending on your behalf, an old printer that e-mails scans. Do not go back to p=none. Find the service in the reports, set up its domain authentication (DKIM with your domain), and the mail passes again. Going back to none re-opens the door for everyone to fix one sender.
How long it takes
For most small companies: two weeks of reports, a week or two of fixing services, then three to five weeks of steps. Six to ten weeks in total, most of it waiting.
Let the reports decide
Perimetry Cloud reads your DMARC reports every day and proposes each step only when the reports show it is safe: no source of yours failing over the last period, enough volume to judge. On the Agency plans it can apply the step in your DNS for you, in Cloudflare, OVHcloud or Gandi, with an undo button.
Once the policy is enforced, the domain can also show its logo in mailboxes that support BIMI: the free BIMI checker reads the record, the logo and the mark certificate.