Moving DMARC from p=none to enforcement safely

How to tighten your DMARC policy without accidentally blocking your own legitimate mail.

✉️ MailMedic5 min readUpdated 2026-08-22

A DMARC record with p=none protects nobody. It only collects reports. That is the correct starting point, but shops often leave it there for years, which means anyone can still send mail pretending to be your store and receivers will deliver it.

Why you cannot just switch to reject

Almost every shop sends mail from more places than it remembers: the store platform, the accounting tool, an old newsletter service, a booking form on a subdomain. Going straight to enforcement blocks whichever ones you forgot — and you find out when a customer says they never received an invoice.

The safe sequence

  1. Stay at p=none for at least two weeks with reports enabled, so you can see every source.
  2. Read the reports. Confirm that each legitimate sender passes either SPF or DKIM.
  3. Fix the ones that fail. This is the actual work, and it is where MailMedic's per-source view saves time.
  4. Move to p=quarantine with pct=25, meaning only a quarter of failing mail is affected. Watch for a week.
  5. Raise to pct=100, watch again, then move to p=reject once nothing legitimate is failing.
v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@your-domain.com
The whole path usually takes four to six weeks for a shop with a few sending tools. There is no benefit to rushing it, and real cost to getting it wrong.

One thing people miss

DMARC requires alignment, not just a pass. The domain in your visible “From” address has to match the domain that SPF or DKIM verified. Mail sent through a service using its own domain can pass SPF and still fail DMARC. MailMedic reports alignment separately for exactly this reason.

Did this answer your question?

If anything here was wrong, unclear or out of date, tell us — the article gets fixed the same day.

Something is missingBack to help centre

Related articles