How to Fix Your DMARC Policy (And Move to p=reject Without Breaking Email)

Why p=none Is (Effectively) Broken

DMARC has three enforcement policies. Understanding what each one actually does — and doesn't do — is the first step to fixing yours.

The good news: most domains can reach p=reject within 2–4 weeks if SPF and DKIM are already configured. The risk of "breaking email" comes from rushing — not from the process itself.

Step 1: Check Your Current DMARC Status

Before changing anything, you need to know exactly what you're working with. Run your domain through a free check to see your current DMARC policy, whether SPF and DKIM are aligned, and what your email security grade is.

Once you have your current status, you'll know:

• Your current DMARC policy (p=none, p=quarantine, or p=reject)
• Whether SPF passes for your sending IPs
• Whether DKIM is signing outgoing mail correctly
• Whether SPF and DKIM alignment is configured correctly for DMARC

If you don't have a DMARC record at all, the fix is simpler — see our DMARC setup guide to add one from scratch. This guide focuses on domains that already have a DMARC record at p=none.

Step 2: Fix SPF and DKIM Before Tightening DMARC

This is the most important step that most guides skip. Do not move your DMARC to p=quarantine or p=reject until your SPF and DKIM are passing correctly for all your legitimate sending services. If you enforce DMARC before your own legitimate mail is authenticated, you'll filter or reject your own emails.

What DMARC alignment requires

For an email to pass DMARC, it must pass either:

• SPF alignment: the domain in the Return-Path (envelope sender) matches your From: domain, AND the IP is in your SPF record
• DKIM alignment: the DKIM signature's d= tag matches your From: domain

Passing DMARC requires alignment — not just passing SPF or DKIM in isolation. A common mistake is having SPF and DKIM both "pass" individually, but failing DMARC alignment because the domains don't match.

Audit every service that sends email as your domain

Make a list of every service that sends email appearing to come from your domain. Common ones that get missed:

• Marketing email (Mailchimp, HubSpot, Klaviyo, Brevo)
• CRM outbound (Salesforce, Pipedrive, HubSpot Sales)
• Transactional email (SendGrid, Postmark, Mailgun, AWS SES)
• Support tools (Zendesk, Intercom, Freshdesk)
• Invoicing and billing (QuickBooks, FreshBooks, Stripe billing)
• Calendar/scheduling tools (Calendly, Acuity)
• HR systems (BambooHR, Workday)
• Your own mail server (if self-hosted)

Each of these needs to either:

1. Be listed in your SPF record as an authorized sender, and use your domain as the envelope sender (SPF alignment)
2. Sign outgoing emails with a DKIM key where d=yourdomain.com (DKIM alignment)

SPF record checklist

Your SPF record at yourdomain.com should include all authorized sending sources. A basic example:

v=spf1 include:_spf.google.com include:sendgrid.net include:mailgun.org ip4:203.0.113.10 ~all

Key rules:

• Stay under 10 DNS lookup mechanisms (each include: counts as one). Use an SPF flattening tool if you're close to the limit.
• End with ~all (softfail) while testing, switch to -all (hardfail) once enforced
• Use ip4: or ip6: for static server IPs (these don't count toward lookup limit)

Step 3: Move to p=quarantine (Safe Intermediate Step)

Once you've confirmed your SPF and DKIM are aligned for all legitimate senders, update your DMARC record to p=quarantine. Start with a low percentage (pct=10) to apply the policy to only 10% of failing mail — this lets you catch unexpected problems before full rollout.

_dmarc.yourdomain.com TXT "v=DMARC1; p=quarantine; pct=10; rua=mailto:[email protected]; fo=1"

Monitor your DMARC reports for 3–7 days. If you see legitimate email being quarantined (showing up in spam), investigate immediately before increasing the percentage. Common causes:

• A sending service you forgot to add to SPF/DKIM
• A forwarding configuration that breaks SPF alignment
• An automated system (cron job, monitoring alert) sending email as your domain

Once the quarantine reports show no unexpected filtering, increase pct gradually: 10 → 25 → 50 → 100, over a week or two.

Step 4: Move to p=reject (Full Enforcement)

Once you've been at p=quarantine; pct=100 for at least a week with no unexpected issues, you're ready for p=reject. This is the only policy that actually prevents spoofing — at quarantine, spoofed emails still reach the recipient (in spam), and some users will open spam. At reject, the attack fails entirely.

_dmarc.yourdomain.com TXT "v=DMARC1; p=reject; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1"

The full parameter breakdown:

• p=reject — reject emails that fail DMARC alignment
• rua= — where aggregate reports go (summary of all mail sources, daily)
• ruf= — where forensic reports go (individual failure details, if supported)
• fo=1 — generate failure reports for any alignment failure (recommended for monitoring)
• adkim=r / aspf=r — relaxed alignment mode (default; allows subdomain matches)

Common Problems and How to Fix Them

Problem: DMARC failing for a specific sender I can't identify

Check your DMARC aggregate reports (rua inbox or a report processor). Look at the IP addresses that are failing. Use a reverse DNS lookup or IP geolocation tool to identify the service. If it's a legitimate service you forgot, add it. If it's an unknown sender — it might be a phishing attempt, and that's exactly what p=reject is designed to block.

Problem: My newsletter tool's emails are failing DMARC

Your newsletter tool is probably sending with its own domain as the envelope sender (common with Mailchimp, Brevo). Set up custom domain authentication in your email platform's settings — this configures DKIM signing with your domain. Most platforms have a guide for this. Once set up, your newsletter emails will pass DMARC via DKIM alignment.

Problem: Google Workspace (formerly G Suite) failing

If you're on Google Workspace, make sure include:_spf.google.com is in your SPF record. Also verify that DKIM is enabled in Google Workspace Admin → Apps → Google Workspace → Gmail → Authenticate email. Google can take up to 48 hours to start signing after enabling.

Problem: Microsoft 365 failing

Add include:spf.protection.outlook.com to your SPF. For DKIM, go to Microsoft 365 Defender (security.microsoft.com) → Email & Collaboration → Policies → DKIM — enable signing for your domain. Like Google, it takes time to propagate.

Problem: SPF is over the 10-lookup limit

SPF has a hard limit of 10 DNS mechanisms that require additional lookups (include:, a, mx). If you exceed this, some receivers will reject or ignore your SPF record entirely. The fix is SPF macro flattening — resolving all the includes to static IP lists. Services like dmarcian's SPF Surveyor, or EasyDMARC's SPF flattener, can help. Or remove sending services you no longer use.

Problem: I have multiple DMARC records

Only one TXT record is allowed at _dmarc.yourdomain.com. If you have multiple, DMARC evaluation fails. Delete the extras and keep only the authoritative one. Check with: nslookup -type=TXT _dmarc.yourdomain.com

Step 5: Monitor Your DMARC After Enforcement

Reaching p=reject is not a one-time task. DMARC can break silently when:

• You onboard a new SaaS tool that sends email as your domain (and forget to authenticate it)
• Someone changes your DNS records (intentionally or accidentally)
• A third-party service updates its sending infrastructure and your SPF include: points to an outdated record
• A DKIM key gets rotated without updating DNS
• Someone "helpfully" adds a second DMARC record

Any of these can silently break DMARC — causing legitimate email to fail, or weakening your spoofing protection. The only way to know when this happens is continuous monitoring with alerts.

The 4-Week DMARC Fix Timeline

To summarize the complete path from p=none to p=reject:

1. Week 1: Audit all sending services. Configure DKIM signing for each. Update SPF to include all senders. Add rua= reporting if not already configured.
2. Week 2: Move to p=quarantine; pct=10. Monitor reports for unexpected filtering. Fix any discovered authentication gaps.
3. Week 3: Increase to p=quarantine; pct=100. Confirm no legitimate mail is being filtered.
4. Week 4: Move to p=reject. Set up continuous monitoring. Done.

DMARC enforcement is one of the most effective, cheapest security controls a business can implement. The worst phishing attacks — the ones that impersonate your CEO to request wire transfers — become impossible when the attacker can't make email appear to come from your actual domain. Get to p=reject and stay there.