# How to get DMARC to p=reject without breaking email

> A step-by-step DMARC enforcement rollout: inventory senders, fix SPF’s 10-lookup limit, align DKIM, move from p=none to quarantine to reject, and lock down parked domains.

By George Rios (geearr) · 2026-10-12 · https://geearr.com/guides/dmarc-p-reject-rollout

**Short answer:** inventory every service that sends mail as your domain, publish DMARC at `p=none` with reporting, fix SPF and DKIM until every legitimate sender passes *aligned*, then step up to `p=quarantine` and finally `p=reject`. For most organizations this takes four to twelve weeks, and the slow part is finding senders — not editing DNS.

## Why p=none is not protection

A DMARC record at `p=none` tells receivers: *“if a message fails authentication, deliver it anyway — just send me a report.”* It is a monitoring mode. Attackers can still spoof your exact domain to your customers, vendors and employees.

Enforcement matters more every year. Google and Yahoo began requiring DMARC for bulk senders in 2024, Microsoft followed for Outlook.com consumer mailboxes in 2025, and cyber insurers and auditors increasingly ask about it. `p=reject` is the only policy that tells receivers to refuse spoofed mail outright.

## How DMARC decides pass or fail

DMARC passes when **either** of these is true:

- **SPF passes and aligns** — the envelope sender (Return-Path) domain matches the visible From: domain.
- **DKIM passes and aligns** — the `d=` domain in a valid DKIM signature matches the visible From: domain.

“Matches” means the same organizational domain under relaxed alignment (the default), so `mail.example.com` aligns with `example.com`. Most rollout failures are alignment failures: a SaaS tool sends with its *own* Return-Path and its *own* DKIM domain, so SPF and DKIM both pass — for the vendor — and DMARC still fails for you.

**Rule of thumb:** make DKIM align for every sender. DKIM survives most forwarding; SPF does not.

## Step 1 — Publish monitoring

```dns
_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com; fo=1"
```

`rua` receives daily aggregate reports (XML) from Google, Microsoft, Yahoo and others. Send them to a DMARC report processor rather than a human inbox — the volume is large and the XML is not meant for reading.

## Step 2 — Inventory every sender

Two weeks of aggregate reports will show every source sending as your domain. Typical findings:

| Sender type | Examples | Usual fix |
| --- | --- | --- |
| Corporate mail | Microsoft 365, Google Workspace | Enable DKIM signing for your domain |
| Marketing | HubSpot, Mailchimp, Braze | Custom DKIM domain + custom Return-Path |
| Transactional | SendGrid, Postmark, Amazon SES | Domain authentication (CNAME DKIM) |
| Support & sales | Zendesk, Salesforce, Intercom | Vendor-specific DKIM setup |
| Billing & HR | Stripe, NetSuite, payroll tools | DKIM, or move to a subdomain |
| Legacy | On-prem relays, printers, scripts | Route through an authenticated relay |
| Unknown | Spoofers, phishing kits | Nothing — that is what enforcement is for |

## Step 3 — Fix SPF without breaking it

- SPF allows **at most 10 DNS lookups**. Every `include:`, `a`, `mx` and `redirect` counts, including nested ones. Exceed it and SPF returns *PermError* for everything.
- Remove includes for services you no longer use. Prefer sending from vendors on a subdomain (`news.example.com`) with its own SPF.
- End with `~all` while monitoring, `-all` once you are confident. Never `+all`.

```dns
example.com.  TXT  "v=spf1 include:spf.protection.outlook.com include:_spf.example-esp.com -all"
```

## Step 4 — Make DKIM align for every sender

Configure each platform to sign with **your** domain, typically by publishing CNAME records the vendor provides. Use 2048-bit keys and rotate them at least annually. Verify in the reports that each source shows `dkim=pass` with your domain.

## Step 5 — Quarantine, then reject

When aggregate reports show legitimate mail passing consistently (aim for 98%+ from known sources):

```dns
_dmarc.example.com.  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"
```

Watch for one to two weeks — failures now land in spam, so complaints surface quickly. Then:

```dns
_dmarc.example.com.  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"
```

Some teams ramp with the `pct` tag; it is being removed in the DMARC revision (DMARCbis), so prefer staging by time or by subdomain instead of building a plan around it.

## Step 6 — Lock down domains that never send mail

Parked, defensive and marketing-only domains are favorite spoofing targets because nobody watches them. Publish all three:

```dns
example.net.         TXT  "v=spf1 -all"
_dmarc.example.net.  TXT  "v=DMARC1; p=reject;"
example.net.         MX   0 .
```

The last record is a Null MX (RFC 7505): it declares the domain accepts no mail at all.

## What breaks — and how to avoid it

- **Forwarding and mailing lists** rewrite or relay messages and break SPF. Aligned DKIM usually survives; ARC helps receivers trust intermediaries.
- **Subdomains** inherit the parent policy unless you set `sp=`. Inventory them too.
- **A forgotten vendor** — the quarterly invoice tool, the HR survey platform. This is why the monitoring phase is not optional.

## DMARC is necessary, not sufficient

DMARC stops exact-domain spoofing. It does not stop lookalike domains (`examp1e.com`), compromised vendor mailboxes, or a real employee account being taken over. Pair enforcement with lookalike-domain monitoring, phishing-resistant MFA and out-of-band verification for any change to payment details. For customer-facing mail in regulated industries, communication provenance — letting a customer verify that a *specific* message really came from you — closes the remaining gap.

Need it done without breaking mail? [geearr email security](/services/email-security) runs the full rollout, including the vendor wrangling.

---
Canonical: https://geearr.com/guides/dmarc-p-reject-rollout · Updated: 2026-10-12 · Site index for LLMs: https://geearr.com/llms.txt