Rolling out DMARC from p=none to p=reject without breaking mail

The DMARC record

DMARC is published as a TXT record at _dmarc.domain. p sets the policy for failing mail: none, quarantine, or reject. rua is where aggregate reports go, sp sets the policy for subdomains, pct applies the policy to a percentage of failing mail, and adkim and aspf set alignment modes.

dig +short TXT _dmarc.example.org
"v=DMARC1; p=none; rua=mailto:dmarc-reports@example.org; fo=1"

Staged rollout

Start at p=none with rua reporting for several weeks to discover every service sending as your domain. Fix alignment for each legitimate sender. Move to p=quarantine with pct=25, then 50 and 100, watching reports and help desk tickets at each step. Finally set p=reject. Set sp explicitly so unused subdomains cannot be spoofed while you work.

• Monitor: p=none with rua
• Fix: align every legitimate sender
• Quarantine: ramp pct 25, 50, 100
• Reject: p=reject
• Subdomains: set sp; reject for unused ones

Lab: write the staged records

For a domain you manage, write the exact TXT record for each stage and the criteria for moving to the next, such as “no legitimate sender failing for two weeks”. Also write the record for a parked domain that never sends mail: SPF with -all and DMARC with p=reject. Review the plan with whoever owns the mail platform before publishing.

stage 1  v=DMARC1; p=none; rua=mailto:dmarc-reports@example.org
stage 2  v=DMARC1; p=quarantine; pct=25; sp=quarantine; rua=mailto:dmarc-reports@example.org
stage 3  v=DMARC1; p=quarantine; pct=100; sp=quarantine; rua=mailto:dmarc-reports@example.org
stage 4  v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc-reports@example.org

parked domain
  TXT @        "v=spf1 -all"
  TXT _dmarc   "v=DMARC1; p=reject; sp=reject"

Common pitfalls

Sending rua reports to a different domain requires that domain to publish an authorization record, or reports will not arrive. Forwarded mail and mailing lists can fail DMARC even for legitimate senders, so watch for those sources in reports before reaching reject.