DMARC is the record that turns email authentication from "detect spoofing" into "block spoofing." It's also the one people are scared to enable, because done carelessly it can send your own legitimate mail to the void. The secret is a staged rollout. Here's the safe path.
What DMARC needs first
DMARC builds on SPF and DKIM — it tells receivers what to do when those checks fail. So before DMARC does anything useful:
| Prerequisite | Status to confirm |
|---|---|
| SPF record published | Lists all your sending sources |
| DKIM signing enabled | Your mail is signed |
If SPF and DKIM aren't solid, fix those first (full guide). DMARC without them does nothing helpful.
The three policies
DMARC's p= tag controls what happens to mail that fails authentication:
| Policy | Effect | Use when |
|---|---|---|
p=none | Monitor only — nothing blocked | Starting out |
p=quarantine | Failing mail → spam folder | Confident, ramping up |
p=reject | Failing mail → blocked entirely | Fully validated |
The whole game is moving safely from none to reject.
The staged rollout
Step 1: Publish p=none with reporting
Add a DMARC TXT record at p=none and turn on aggregate reports (the rua tag). This blocks nothing — it just starts sending you reports on who's sending mail as your domain.
p=noneis your reconnaissance phase. It does no enforcement, so it's completely safe — but the reports reveal every source sending as you, including legitimate services you forgot about and spoofers. Don't skip it.
Step 2: Read the reports
For a few weeks, study the reports. The goal: make sure all your legitimate mail passes SPF or DKIM. You'll often discover a forgotten sender (a CRM, a support tool, a payment provider) that needs adding to SPF/DKIM. Fix those gaps now — while nothing is being blocked.
Step 3: Move to p=quarantine
Once you're confident your real mail passes, tighten to p=quarantine. Now failing mail goes to spam rather than the inbox. Consider starting with a percentage (pct=) to ramp gradually. Watch for any legitimate mail getting caught.
Step 4: Move to p=reject
When quarantine has run cleanly, go to p=reject. Now spoofed mail is blocked outright — full protection against exact-domain spoofing. This is the destination.
A handy timeline
| Phase | Policy | Duration (typical) |
|---|---|---|
| Monitor | p=none | 2–4 weeks |
| Soft enforce | p=quarantine (ramp pct) | 2–4 weeks |
| Full enforce | p=reject | Ongoing |
The cardinal rule
Never jump straight to
p=reject. If a legitimate sender isn't covered by SPF/DKIM, reject will silently block your real mail — receipts, resets, the lot. Always go none → quarantine → reject, reading the reports at each step.
A monitoring connection
Once enforced, DMARC must keep working. A DNS change that drops your SPF/DKIM, or a key rotation, can suddenly make your own mail fail under p=reject. Monitoring your email policy records catches that drift before it bins your email.
The bottom line
| Step | In one line |
|---|---|
| Prereq | Solid SPF + DKIM first. |
1. p=none | Monitor safely; read the reports. |
2. p=quarantine | Ramp enforcement; failing mail to spam. |
3. p=reject | Full protection; spoofing blocked. |
DMARC is the difference between detecting spoofing and stopping it — but it rewards patience. Roll out none → quarantine → reject, fix every legitimate sender along the way, and you get airtight protection without ever losing your own email.
Related: SPF, DKIM & DMARC, domain spoofing; check your DMARC with the free DMARC checker.