How to Move DMARC from p=none to p=reject Safely
Summary
A practical DMARC enforcement guide recommends authenticating every legitimate sender, reviewing aggregate reports, testing quarantine with a gradual rollout, and then moving to p=reject while accounting for forwarding and receiver limitations.
Key points
- The article explains that p=none monitors authentication but does not ask receiving servers to block messages that fail DMARC.
- Inventory every service sending email for the domain, configure aligned DKIM and SPF, and address issues such as duplicate SPF records and the SPF lookup limit before enforcement.
- Use aggregate DMARC reports to identify legitimate and unrecognized senders, while treating the reports as incomplete because not all receivers provide the same data or send reports.
- Move to p=quarantine before p=reject; the guide suggests gradually increasing pct from 10% to 25%, 50%, and 100%, then monitoring at full quarantine before proceeding.
- At p=reject, receiving servers are asked to reject messages that fail DMARC, but some providers may not honor the policy; forwarded mail can also fail authentication.
- Keep monitoring after enforcement and authenticate new sending platforms before use. The article also recommends considering MTA-STS, TLS-RPT, and DNSSEC as complementary email and DNS protections.
Article Details
- Defense Focus
- Safely enforce DMARC to reduce domain spoofing and phishing while preserving legitimate email delivery.
- Detection Methods
- Collect and parse aggregate DMARC reports; compare reported sending sources against the organization's sender inventory.
- Identify unrecognized sending IP addresses and mail servers, and track their message volumes and destinations where recipient-domain data is available.
- Verify that every legitimate source passes DKIM and SPF with proper alignment before enforcement.
- Monitor authentication failures during a staged quarantine rollout and continue reviewing reports after enforcement.
- Use domain-reputation and spam-complaint monitoring, plus feedback-loop data, as additional visibility.
- Data Sources
- DMARC aggregate reports in XML from receiving mail servers, including sending IP addresses, DKIM and SPF results, and message volumes.
- Recipient or envelope-to domain data when included in reports; the article notes Microsoft reports may include it while Google reports do not.
- Google Postmaster Tools and Yahoo Postmaster Tools data on domain reputation and spam complaint rates.
- Feedback-loop data received at abuse@ and postmaster@ addresses.
- Rule Types
- DMARC DNS record configuration, including the rua, p, and pct tags.
- SPF DNS records and DKIM DNS records/signing configuration.
- DMARC aggregate report format (XML).
- Defensive Actions
- Inventory all legitimate services sending mail for the domain, including infrequent and seasonal senders.
- Configure DKIM signing and SPF for each sending source, ensuring alignment with the From domain; authenticate subdomains independently.
- Clean up obsolete or duplicate SPF entries and keep each SPF record within the 10-lookup limit.
- Monitor DMARC reports until all known legitimate sources pass authentication and unexplained sources have been assessed.
- Move from p=none to p=quarantine first, applying quarantine gradually with pct values such as 10%, 25%, 50%, then 100%; investigate failures before increasing enforcement.
- Move to p=reject after the quarantine phase is clean, and continue monitoring for new or unauthorized senders.
- Communicate that new email-sending services require DNS and authentication configuration before use.
- Review forwarding-related authentication failures without treating them as a reason to abandon enforcement.
- Remove deprecated DNS records and consider implementing MTA-STS, TLS-RPT, and DNSSEC.
MITRE ATT&CK
Vendors
GoogleInventory every sender. Google Workspace or Microsoft 365 for corporate email. Your CRM. Your marketing automation platform. Your transactional email service. Your helpdesk. Your billing system. Your project managementMailerLiteAnother thing p=reject won't stop: an ESP that forces include:_spf.mlsend.com on your root domain — MailerLite prescribes exactly this configuration, and it lets their entire shared pool pass your DMARC.MicrosoftInventory every sender. Google Workspace or Microsoft 365 for corporate email. Your CRM. Your marketing automation platform. Your transactional email service. Your helpdesk. Your billing system. Your project managementMimecast365 silently overrides DMARC as oreject when tenants run behind third-party gateways like Proofpoint or Mimecast, with no aggregate report telemetry to surface the bypass. That's a gap to be aware of, not a reason toProofpointMicrosoft 365 silently overrides DMARC as oreject when tenants run behind third-party gateways like Proofpoint or Mimecast, with no aggregate report telemetry to surface the bypass. That's a gap to be aware of, notYahoowhere aggregate reports are sent. These reports come from receiving mail servers (Gmail, Microsoft, Yahoo, etc.) and tell you which IP addresses are sending email using your domain, whether those messages passed
Products
Google WorkspaceInventory every sender. Google Workspace or Microsoft 365 for corporate email. Your CRM. Your marketing automation platform. Your transactional email service. Your helpdesk. Your billing system. Your project managementMicrosoft 365 Apps for EnterpriseInventory every sender. Google Workspace or Microsoft 365 for corporate email. Your CRM. Your marketing automation platform. Your transactional email service. Your helpdesk. Your billing system. Your project management
Tools
Google Postmaster ToolsBeyond DMARC reports, set up Google Postmaster Tools and Yahoo Postmaster Tools to monitor domain reputation and spam complaint rates. Create standard abuse@ and postmaster@ email addresses to receive feedback loopYahoo Postmaster ToolsBeyond DMARC reports, set up Google Postmaster Tools and Yahoo Postmaster Tools to monitor domain reputation and spam complaint rates. Create standard abuse@ and postmaster@ email addresses to receive feedback loop