Practice · Guide

DMARC policy guide: safely to p=reject.

The stepwise path from monitoring to full protection, gain certainty without losing legitimate email.

The three stages at a glance

1. p=none Monitoring 2-6 weeks 2. p=quarantine Spam folder 2-4 weeks 3. p=reject Full defence permanent
Recommended timeline, 1-3 months total

Stage 1, p=none (monitoring)

Goal: understand who is sending under your name. No impact on delivery yet.

"v=DMARC1; p=none; rua=mailto:[email protected]; pct=100"

What you do during this phase:

Reports arrive as XML and are hard to read in raw form. Mailantis parses, aggregates and visualises them, you see at a glance which IP is still not making it.

Stage 2, p=quarantine (pct=100)

Once the monitoring reports look clean: move the policy directly to quarantine with pct=100. A staged rollout via pct=10/25/50/75 sounds cautious but weakens protection: attackers can randomly hit the unprotected percentage, and the pct value is visible to recipients through aggregate reports anyway.

"v=DMARC1; p=quarantine; pct=100; rua=mailto:[email protected]"

Hold this stage for at least 2-4 weeks and check the reports: no more legitimate senders ending up in spam, visible spoofing is caught, then it is time for p=reject. Prerequisite for the direct jump: stage 1 was carried out properly and all your own senders pass DMARC.

Stage 3, p=reject

The home straight. From now on, unauthenticated mail is rejected outright by the recipient server, not even visible in spam any more.

"v=DMARC1; p=reject; pct=100; rua=mailto:[email protected]; adkim=s; aspf=s"

Common pitfalls

Timeline, guide value

WeekAction
1Set up SPF + DKIM for all main systems.
2Publish DMARC p=none with rua.
3-6Analyse reports, fix deviations.
7-10p=quarantine; pct=100, monitor aggregate reports, check the spam folder for legitimate senders.
11-12p=reject.

Key takeaways

  • Start with p=none and rua to see for 2-6 weeks who is sending under your domain.
  • During this phase, set up SPF and DKIM for every legitimate sender until they all align cleanly in the aggregate reports.
  • Then move directly to p=quarantine; pct=100, no staged pct rollout, as it leaves the unprotected share exposed.
  • Set p=reject only once 100% of your own senders pass DMARC for 4+ weeks. The full path takes 1-3 months.

Frequently asked questions

How do I choose the right pct value?

pct controls what percentage of mail the policy is applied to. Our recommendation: at p=none, pct is irrelevant. When switching to p=quarantine, set pct=100 right away, a staged rollout (10/25/50/75) leaves the unprotected share open to spoofing and is visible in the aggregate report anyway. Instead of tweaking pct, monitor longer at p=none until all your own senders align cleanly.

What about newsletter tools?

Newsletter ESPs (Mailchimp, Sendgrid, Brevo) must have custom-domain authentication enabled. Otherwise neither SPF nor DKIM aligns with your From domain, and DMARC fails on ESP sends.

How do I identify legitimate senders?

From the DMARC aggregate reports: resolve source_ip via reverse lookup, identify the provider, compare volumes. Mailantis recognises the 50 most common providers automatically.

When is it safe to move to p=reject?

When for 4+ weeks all aggregate reports show: 100% of your own senders pass DMARC, and visible spoofing attempts are already landing in spam thanks to p=quarantine.

What happens with auto-forwarding?

Pure SPF forwarding fails (the sender IP changes). DKIM almost always survives. That is why DKIM is critical for forwarding-resilient DMARC configurations.