From DMARC none to reject in four steps

5 min read · Updated on 20 October 2026

DMARC tells receiving mail servers what to do with mail that falsely claims to come from your domain. The goal is p=reject. The safest way to get there is in steps.

SPF and DKIM first

DMARC builds on SPF and DKIM. A message passes DMARC when SPF or DKIM passes and its domain matches the domain in the From address. This is called alignment. The DMARC standard recommends using both SPF and DKIM.

Since February 2024, Google and Yahoo have required bulk senders to have SPF, DKIM and a DMARC record. For Google this means more than 5,000 messages a day to Gmail. A policy of p=none is enough for that. If you want to go beyond the minimum, you work towards reject.

The four steps

1. Publish p=none with reporting. For example: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. Receivers then send you aggregate reports, usually daily. Delivery does not change yet.
2. Map all senders. Check the reports to see which services send mail on behalf of your domain. Think of your newsletter service, CRM, invoicing software, website and printers. Make sure each service signs with DKIM for your domain or uses its own subdomain.
3. Move to p=quarantine. Mail that fails then ends up in the recipient junk folder or in quarantine.
4. Move to p=reject. Receivers that apply DMARC then refuse mail that fails. This makes abuse of your domain much harder.

The DMARC standard itself says domain owners usually start with p=none. This lets you check that nothing was missed in your SPF and DKIM setup.

How long does each step take?

There is no fixed rule. Microsoft talks about enough time to monitor the effects. Microsoft advises reviewing the reports weekly during deployment, and monthly once everything is stable.

Advice: stay on p=none for at least a few weeks, and longer if you use many different services. Then stay on quarantine for several weeks before moving to reject. Only continue when the reports show nothing but unknown or malicious senders.

You may read about the pct tag for applying a policy to a share of messages. The new DMARC standard, RFC 9989 from May 2026, removes pct. So do not base your plan on pct.

Subdomains and unused domains

A DMARC record also covers subdomains that have no record of their own. The sp tag sets a separate policy for subdomains.

For external senders, such as a newsletter service, preferably use a separate subdomain with its own SPF, DKIM and DMARC. That way a problem at that service does not affect your main domain.

Do you have domains that never send mail? Microsoft advises publishing v=DMARC1; p=reject for them straight away.

Checklist

• Check SPF and DKIM for every domain that sends mail.
• Publish p=none with a rua address on a shared mailbox.
• List all services that send mail on your behalf.
• Fix alignment problems service by service.
• Move through quarantine to reject.
• Set unused domains to p=reject straight away.
• Keep reviewing the reports every month.

Sources

• RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)
• Microsoft Learn: Set up DMARC to validate email in Microsoft 365
• Google: Email sender guidelines
• Yahoo: Sender Best Practices