Rolling out DMARC from p=none to p=reject

Yes. DMARC (RFC 7489) lets your domain publish a policy telling receiving mail servers how to handle messages that fail authentication, and sends you reports on who is sending as you. Google requires DMARC from anyone sending 5,000 or more messages a day to Gmail accounts. A p=none policy meets that minimum; only quarantine or reject actually blocks spoofed mail.

DMARC (Domain-based Message Authentication, Reporting and Conformance, defined in RFC 7489) lets you tell receiving mail servers what to do with mail that claims to come from your domain but fails authentication, and asks them to send you reports. If you want the background on SPF, DKIM and DMARC first, read our explainer on email spoofing. This guide is the how-to.

Two things motivate most rollouts today. First, spoofing: without an enforced DMARC policy, anyone can send mail with your domain in the From line, and your clients may believe it. Second, deliverability: Google's email sender guidelines require bulk senders to Gmail to publish DMARC (p=none is accepted) with aligned SPF or DKIM, and Yahoo's sender best practices say the same.

You can't protect a domain until you know who legitimately uses it. List everything that sends mail with your domain in the From address:

• Your main mail platform (Microsoft 365 or Google Workspace).
• Marketing and newsletter tools, CRMs and survey tools.
• Accounting, invoicing and payroll systems that email statements or pay stubs.
• Booking, e-commerce, help desk and e-signature platforms.
• Website contact forms and the web host's mail server.
• Scanners, copiers and line-of-business apps that send alerts.
• Agencies or outsourced partners sending on your behalf.

DMARC passes when a message passes SPF or DKIM and the domain that passed is aligned with (the same as, or by default an organizational match for) the domain in the visible From address. RFC 7489 defaults to relaxed alignment for both, so mail.yourcompany.ca aligns with yourcompany.ca.

For each sender from step 1:

• DKIM first. Turn on DKIM signing with your own domain (not the vendor's) wherever the service supports it. DKIM survives most forwarding; SPF doesn't. Yahoo asks for keys of at least 1024 bits; use 2048 where the provider offers it.
• SPF second. Add the service's include to your SPF record only if it sends with your domain as the envelope sender. RFC 7208 limits SPF evaluation to 10 DNS-querying terms; exceed it and SPF returns a permanent error, which fails everything. Remove includes for services you no longer use.
• Use subdomains for bulk senders where practical (for example news.yourcompany.ca for marketing). It isolates reputation and keeps your main SPF record short.

Publish a TXT record at _dmarc.yourcompany.ca such as v=DMARC1; p=none; rua=mailto:[email protected]. The p=none policy asks receivers to take no action, and the rua address receives aggregate reports, typically daily (the RFC's default reporting interval is 86,400 seconds).

Google recommends starting at none and moving to quarantine or reject over time. Stay here until reports show every legitimate source passing with alignment, usually a few weeks to a couple of months depending on how many senders you have and how often they send. Monthly and quarterly senders (statements, tax slips) need time to appear. Our guide to reading DMARC aggregate reports explains how to work through them.

Quarantine asks receivers to treat failing mail as suspicious, usually by putting it in spam. RFC 7489 defines an optional pct tag (0-100, default 100) that applies the policy to only a percentage of failing mail. Google recommends using pct during rollout. A typical ramp:

At p=reject, receivers are asked to refuse failing mail outright, so spoofed messages never reach the inbox or spam folder. The M3AAWG email authentication best practices recommend p=reject where possible and p=quarantine otherwise, and describe p=none and pct below 100 as transitional states. Ramp the same way: pct=10, then 50, then 100.

Also set a subdomain policy. The sp tag sets the policy for subdomains; if it's absent, subdomains inherit p. Attackers like unused subdomains (billing.yourcompany.ca) because owners forget them. Parked domains that never send mail should publish p=reject and an SPF record of v=spf1 -all.

Sources: RFC 7489 (DMARC) and RFC 7208 (SPF), IETF; M3AAWG Email Authentication Recommended Best Practices (2020); Google 'Email sender guidelines' and 'Set up DMARC'; Yahoo Sender Best Practices.

• Make DMARC part of procurement: any new tool that sends email as you must support DKIM with your domain before it goes live.
• Keep reading aggregate reports monthly. New failures from a legitimate source mean a vendor changed something.
• Rotate DKIM keys periodically; M3AAWG publishes separate guidance on key rotation.
• Watch the SPF lookup count every time someone adds an include.
• Review ownership of every domain and subdomain you hold, including old brand names, at least yearly.