The DMARC Enforcement Path

The sequence

p=none  →  fix senders  →  p=quarantine (pct=25)  →  pct=100  →  p=reject

Each step has a purpose. Rushing through them is how organizations end up blocking their own CRM, payroll system, or ticketing tool from delivering email.

Phase 1: Monitor with p=none

Start with this record:

_dmarc.yourdomain.com TXT "v=DMARC1; p=none; rua=mailto:reports@yourdomain.com"

p=none tells receivers to take no action on failing mail. You get the reports; nobody gets blocked. This phase is about discovery, not protection.

Stay here for at least two to four weeks. You need a representative sample of your mail traffic, including infrequent senders like quarterly billing systems or occasional bulk campaigns.

Use a DMARC reporting tool to read the XML aggregate reports. Reading them manually is painful. The reports show you every source sending mail as your domain and whether each is passing SPF alignment, DKIM alignment, or failing both.

Phase 2: Inventory and fix senders

From your reports, you'll typically find three categories:

Passing cleanly: Google Workspace, Microsoft 365, and similar platforms that are already configured correctly. Leave them alone.

Legitimate but failing alignment: Your CRM sends as notifications@yourcompany.com but doesn't sign with DKIM under your domain. Your helpdesk tool's SPF domain doesn't align. These need to be fixed before you enforce.

Common fixes:

• Enable a custom DKIM domain at the vendor (publish a CNAME in your DNS).
• Configure a custom return-path domain at the vendor.
• Add the vendor to your SPF record if they're not already included.
• Move bulk or marketing email to a subdomain you control fully.

Unauthorized / spoofing: Sources you don't recognize sending as your domain. These are the messages DMARC is designed to block. Do not fix them. They are why you're doing this.

Phase 3: Quarantine at low percentage

Once every legitimate sender is passing alignment, move to quarantine. Start at a low percentage:

_dmarc.yourdomain.com TXT "v=DMARC1; p=quarantine; pct=25; rua=mailto:reports@yourdomain.com"

pct=25 means this policy applies to 25% of failing messages. The other 75% are treated as if the policy is p=none. This lets you validate that enforcement doesn't cause unexpected problems at low risk.

Watch your reports for a week. If no new failures surface from legitimate sources, move to higher percentages:

pct=50  →  pct=100

Phase 4: Full quarantine

_dmarc.yourdomain.com TXT "v=DMARC1; p=quarantine; pct=100; rua=mailto:reports@yourdomain.com"

At this point, all mail that fails DMARC alignment will be routed to spam or junk at participating receivers. Monitor for another week or two. If your legitimate mail is landing correctly, you're ready for reject.

Phase 5: Reject

_dmarc.yourdomain.com TXT "v=DMARC1; p=reject; rua=mailto:reports@yourdomain.com"

Receiving servers that honor DMARC will now outright reject mail that fails your policy. For most domains, this is the goal. Spoofed messages claiming to be from you will not reach inboxes at major receivers.

A realistic timeline

Phase	Policy	Duration
Monitor	p=none	2–4 weeks
Fix senders	p=none	As needed
Soft enforcement	p=quarantine; pct=25	1 week
Full quarantine	p=quarantine; pct=100	1–2 weeks
Reject	p=reject	Ongoing

Simple domains with one or two mail sources can move through this in a few days. Organizations with many vendors may take several weeks to reach full enforcement.

Keep monitoring after reject

Reaching p=reject is not the end. New vendors get added, keys rotate, and SPF records drift. DMARC reports should be reviewed regularly to catch failures before they become problems. This is especially important after adding a new service that sends email, migrating mail platforms, or making changes to DNS.