Moving DMARC from p=none to p=reject without blocking real email

Short answer: publish p=none with a reporting address, read the aggregate reports until every legitimate sender passes DMARC, then move to p=quarantine and finally p=reject. For most organisations this takes four to eight weeks. The work is in the middle step: finding the senders you forgot about.

Why it matters

p=none only monitors. Receivers still deliver mail that fails DMARC, so anyone can send an invoice or a password reset email that shows your exact domain in the From line. Only p=reject (and to a lesser extent p=quarantine) stops that. It is also what the Australian ISM (ISM-1540) and the UK NCSC ask for.

Stage 1: Monitor (week 0)

_dmarc.example.com. IN TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

Use a mailbox or a DMARC reporting service you will actually read. Reports are XML, one per receiver per day.
If the address is on another domain, that domain must authorise it. See sending reports to another domain.
Make a list of every system that sends as your domain: mailboxes, website forms, CRM, marketing, accounting, payroll, helpdesk, monitoring alerts, scanners and printers.

Stage 2: Fix every legitimate sender (weeks 1 to 4)

Group the report rows by sending source. For each source that is yours, make at least one of these pass and align with your From domain:

DKIM (preferred). Turn on DKIM signing with your own domain in that service. DKIM survives forwarding, SPF does not.
SPF. Only aligns if the service sends with a Return-Path on your domain. Add its include to your SPF record, watching the 10-lookup limit.

Typical failures you will find, and what they mean:

What you see	Usually	Action
A known vendor, SPF pass but not aligned, no DKIM	The vendor uses its own bounce domain	Enable custom DKIM for your domain in the vendor.
Your own IP address failing	A server or device not in SPF	Add it, or route it through your mail platform.
Large providers with DKIM pass from your domain but SPF fail	Forwarded mail	Fine: DKIM still aligns.
Mailing list servers, DKIM fail	The list changed the message	Expected. Receivers increasingly use ARC for these.
Unknown IPs in countries you do not operate in	Spoofing	This is what reject will stop.

Move on when legitimate sources pass for two full weeks, including month-end jobs like invoices and payroll.

Stage 3: Quarantine (weeks 4 to 6)

_dmarc.example.com. IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com"

Failing mail now goes to spam instead of the inbox, so a missed sender is an annoyance rather than an outage. If you want an even softer step, the new standard (RFC 9989) adds t=y, which asks receivers to apply one level less than the stated policy. Older guides use pct= for this, but pct is now historic and receivers following RFC 9989 ignore it.

Stage 4: Reject

_dmarc.example.com. IN TXT "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com"

Leave out sp= so subdomains inherit reject. If you have it, make sure it is not sp=none.
Keep the rua address and keep reading reports. New services get added without anyone telling IT.
Do the same for every other domain you own, including the ones that never send email. See protecting parked domains.

Rollback plan

If a business-critical sender starts failing after you enforce, change only the policy back to p=quarantine or p=none while you fix it. Set a low TTL (for example 300 seconds) on the DMARC record before each change so a rollback takes effect quickly.

Check where you are

The DMARC checker shows which stage a domain is at, whether subdomains are covered, and whether your report addresses will actually receive reports.