DMARC rollout plan: from p=none to quarantine to reject

Roll out DMARC in stages: publish p=none with reporting, find and fix every legitimate sender, move to quarantine, then to reject once reports are clean. RFC 9989 suggests at least a month at none and an equal period at quarantine for domains whose users post to mailing lists.

Stage 0: inventory

Before touching DNS, list what sends mail as your domain: your mail platform, marketing tools, ticketing, billing, CRM, monitoring alerts, scanners and any application sending directly. Ask each team. Reports will find the rest.

Microsoft's guidance suggests starting with a domain or subdomain that has low mail volume and few sources, which limits the damage from a mistake.

Stage 1: monitor with p=none

Publish a record at _dmarc.yourdomain:

_dmarc.example.com.  IN TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

The rua tag asks receivers to send aggregate reports. Without it, receivers must not generate them. RFC 9989 calls this state Monitoring Mode. Gmail's bulk sender rules say the policy can be none, and Yahoo asks for at least p=none for bulk senders, so this stage already helps with those requirements.

Collect reports for at least a few weeks. The RFC's guidance for domains with ordinary users is at least a month.

Stage 2: fix failures

For each source in the reports that sends legitimate mail but fails DMARC:

• Add the service to SPF, or better, enable DKIM signing with your own domain so the signature aligns.
• Check that it uses a From address on your domain.
• Re-read the reports a week later and confirm the failure is gone.

Unknown sources that you do not recognize are the spoofing you are trying to block. Leave them failing.

Stage 3: quarantine

Change to p=quarantine. Receivers treat failing mail as suspicious, typically sending it to spam. RFC 9989 adds a t=y testing flag that asks receivers not to apply the policy while still applying any special handling. It also expects the effective treatment to be one level lower, so quarantine under test acts like none.

_dmarc.example.com.  IN TXT  "v=DMARC1; p=quarantine; t=y; rua=mailto:dmarc-reports@example.com"

Remove t=y when reports look clean. The older pct tag for partial enforcement has been removed from the standard. See the pct and t post.

Stage 4: reject, or stay at quarantine

Move to p=reject when no legitimate mail fails. Two cautions from RFC 9989:

• Domains that publish reject must not rely on SPF alone and must apply valid DKIM signatures, since forwarding breaks SPF.
• Domains whose staff post to mailing lists should not publish reject, because list mail with an unchanged From header is often rejected. For those, quarantine may be the right stopping point.

For a domain that only sends system mail, reject is usually reasonable. The mailing lists post goes deeper.

Quick check

Sources

• RFC 9989, DMARC
• Microsoft Learn, set up DMARC
• Google, email sender guidelines
• Yahoo Sender Hub, sender requirements

Last reviewed: 19 October 2026.