Move DMARC from p=none to quarantine or reject safely

What it means

With p=none, your DMARC record only collects reports. Receivers still deliver emails that fail the checks, including fake ones sent by scammers in your name.

• p=quarantine: emails that fail DMARC go to the spam folder.
• p=reject: emails that fail DMARC are refused. This is full protection.

Why it matters

Phishing and fake invoices using your domain hurt your customers and your reputation. A strong DMARC policy blocks them. It is also required to show your logo in Gmail and other mailboxes (BIMI). The risk is moving too fast: if one of your real sending tools is not set up correctly, its emails are blocked too.

How to check where you are

Delivmail checks this for you in two ways:

• Send a test email: on the home page, copy your unique test address, send it a normal email from the mailbox you want to check, then open the report. The DMARC line shows your current policy.
• Use the Domain scanner: type your domain at /domain-scanner to read your DNS records without sending anything.

Step-by-step plan

Step 1: monitor for 2 to 4 weeks

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Read the reports and list every source sending with your domain: your mailbox provider, newsletter tool, shop, invoicing software, CRM, helpdesk. Delivmail DMARC monitoring in the paid dashboard groups them for you.

Step 2: fix every legitimate source

Each real source must pass SPF or DKIM for your domain. Set up DKIM in each tool and add it to SPF. Send a Delivmail test from each tool to confirm. Sources you do not recognize are often spoofing: they are exactly what DMARC will block.

Step 3: quarantine, gradually

Use the pct tag to apply the policy to part of the failing emails first:

v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@yourdomain.com

Wait a week or two, check the reports and your customers' feedback, then raise to 50, then 100:

v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com

Step 4: reject

After a few clean weeks at full quarantine:

v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com

You can use pct again for a smoother move. Keep the rua address: reports stay useful forever.

Subdomains

By default, subdomains follow your main policy. If your record says sp=none, fake emails from any subdomain are still delivered. Remove it, or set sp=reject once you are sure no subdomain sends unsigned emails.

Warning signs to watch

• Customers saying your invoices or newsletters went to spam.
• A known tool appearing as failing in the reports.
• A new tool added by a colleague without DNS setup.

If something breaks, you can always go back one step by editing the record. Fix the source, then move forward again.

Domains that never send email

For domains you own but do not use for email, go straight to reject, together with an empty SPF:

_dmarc.example.com  TXT  "v=DMARC1; p=reject;"
example.com         TXT  "v=spf1 -all"

Check that it is fixed

Run the Domain scanner after each change to confirm the new policy is published. Send test emails from each of your tools: DMARC should pass for all of them.