How to get DMARC to p=reject without breaking email

Short answer: inventory every service that sends mail as your domain, publish DMARC at p=none with reporting, fix SPF and DKIM until every legitimate sender passes aligned, then step up to p=quarantine and finally p=reject. For most organizations this takes four to twelve weeks, and the slow part is finding senders — not editing DNS.

Why p=none is not protection

A DMARC record at p=none tells receivers: “if a message fails authentication, deliver it anyway — just send me a report.” It is a monitoring mode. Attackers can still spoof your exact domain to your customers, vendors and employees.

Enforcement matters more every year. Google and Yahoo began requiring DMARC for bulk senders in 2024, Microsoft followed for Outlook.com consumer mailboxes in 2025, and cyber insurers and auditors increasingly ask about it. p=reject is the only policy that tells receivers to refuse spoofed mail outright.

How DMARC decides pass or fail

DMARC passes when either of these is true:

• SPF passes and aligns — the envelope sender (Return-Path) domain matches the visible From: domain.
• DKIM passes and aligns — the d= domain in a valid DKIM signature matches the visible From: domain.

“Matches” means the same organizational domain under relaxed alignment (the default), so mail.example.com aligns with example.com. Most rollout failures are alignment failures: a SaaS tool sends with its own Return-Path and its own DKIM domain, so SPF and DKIM both pass — for the vendor — and DMARC still fails for you.

Rule of thumb: make DKIM align for every sender. DKIM survives most forwarding; SPF does not.

Step 1 — Publish monitoring

_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com; fo=1"

rua receives daily aggregate reports (XML) from Google, Microsoft, Yahoo and others. Send them to a DMARC report processor rather than a human inbox — the volume is large and the XML is not meant for reading.

Step 2 — Inventory every sender

Two weeks of aggregate reports will show every source sending as your domain. Typical findings:

Sender type	Examples	Usual fix
Corporate mail	Microsoft 365, Google Workspace	Enable DKIM signing for your domain
Marketing	HubSpot, Mailchimp, Braze	Custom DKIM domain + custom Return-Path
Transactional	SendGrid, Postmark, Amazon SES	Domain authentication (CNAME DKIM)
Support & sales	Zendesk, Salesforce, Intercom	Vendor-specific DKIM setup
Billing & HR	Stripe, NetSuite, payroll tools	DKIM, or move to a subdomain
Legacy	On-prem relays, printers, scripts	Route through an authenticated relay
Unknown	Spoofers, phishing kits	Nothing — that is what enforcement is for

Step 3 — Fix SPF without breaking it

• SPF allows at most 10 DNS lookups. Every include:, a, mx and redirect counts, including nested ones. Exceed it and SPF returns PermError for everything.
• Remove includes for services you no longer use. Prefer sending from vendors on a subdomain (news.example.com) with its own SPF.
• End with ~all while monitoring, -all once you are confident. Never +all.

example.com.  TXT  "v=spf1 include:spf.protection.outlook.com include:_spf.example-esp.com -all"

Step 4 — Make DKIM align for every sender

Configure each platform to sign with your domain, typically by publishing CNAME records the vendor provides. Use 2048-bit keys and rotate them at least annually. Verify in the reports that each source shows dkim=pass with your domain.

Step 5 — Quarantine, then reject

When aggregate reports show legitimate mail passing consistently (aim for 98%+ from known sources):

_dmarc.example.com.  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"

Watch for one to two weeks — failures now land in spam, so complaints surface quickly. Then:

_dmarc.example.com.  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"

Some teams ramp with the pct tag; it is being removed in the DMARC revision (DMARCbis), so prefer staging by time or by subdomain instead of building a plan around it.

Step 6 — Lock down domains that never send mail

Parked, defensive and marketing-only domains are favorite spoofing targets because nobody watches them. Publish all three:

example.net.         TXT  "v=spf1 -all"
_dmarc.example.net.  TXT  "v=DMARC1; p=reject;"
example.net.         MX   0 .

The last record is a Null MX (RFC 7505): it declares the domain accepts no mail at all.

What breaks — and how to avoid it

• Forwarding and mailing lists rewrite or relay messages and break SPF. Aligned DKIM usually survives; ARC helps receivers trust intermediaries.
• Subdomains inherit the parent policy unless you set sp=. Inventory them too.
• A forgotten vendor — the quarterly invoice tool, the HR survey platform. This is why the monitoring phase is not optional.

DMARC is necessary, not sufficient

DMARC stops exact-domain spoofing. It does not stop lookalike domains (examp1e.com), compromised vendor mailboxes, or a real employee account being taken over. Pair enforcement with lookalike-domain monitoring, phishing-resistant MFA and out-of-band verification for any change to payment details. For customer-facing mail in regulated industries, communication provenance — letting a customer verify that a specific message really came from you — closes the remaining gap.

Need it done without breaking mail? geearr email security runs the full rollout, including the vendor wrangling.