DMARC p=none to Quarantine to Reject: A 30-Day Plan With Exact Records

A DMARC record with p=none tells the world you are watching but not acting. Attackers can still send mail as your domain, and receivers will still deliver it. Moving to p=reject is where the protection actually starts, and it can be done in a month if you change one value at a time and read the reports between steps. Here is the exact sequence, with the record for each stage.

Quick answer

Start at p=none with reporting enabled, confirm every legitimate sender passes SPF or DKIM with alignment, move to p=quarantine with pct=25, raise pct to 100, then switch to p=reject. Each stage is a single TXT records (short text lines in DNS used for email security) at _dmarc.yourdomain.com. Do not skip the reporting stage; it is how you find the newsletter tool or invoicing app you forgot you use.

Day 1: publish p=none with reporting

If you have no DMARC record yet, or one without a rua address, start here. This is the value OquMail gives you during domain setup:

_dmarc.yourdomain.com  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com"

Replace DMARC (a policy that tells providers what to do if someone fakes your domain)@yourdomain.com with a real mailbox you can read. On the OquMail free plan you can create it as one of your 15 mailboxes at no cost. Receivers such as Gmail, Yahoo, and Microsoft will begin sending daily XML aggregate reports there within 24 to 48 hours.

Days 2 to 10: read reports and fix alignment

1. Open each aggregate report and list every source IP or sending service that sent mail using your domain.
2. For each legitimate source, confirm at least one of SPF or DKIM shows "pass" with alignment. Alignment means the domain that passed matches the domain in the visible From header.
3. Mail sent through OquMail should pass both, because SPF is v=spf1 MX (Mail Exchanger — where incoming email is delivered) a:mail.oqumail.com ~all and DKIM is signed with your domain's own selector.
4. For third-party tools (a newsletter service, an invoicing app, a CRM), enable DKIM signing with your own domain inside that tool. A tool that can only sign with its own domain will fail alignment even when DKIM passes.
5. Anything that is neither yours nor a tool you recognise is spoofing. You do not fix it; the next stages block it.

Day 11: move to quarantine at 25 percent

Once every legitimate source aligns, tighten the policy. The pct tag applies the policy to a fraction of failing mail, so a mistake affects a quarter of messages rather than all of them.

_dmarc.yourdomain.com  TXT  "v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@yourdomain.com"

Day 18: quarantine at 100 percent

If the reports for the previous week show no legitimate source failing, remove the pct tag (100 is the default). Failing mail now goes to spam at every receiver that honours DMARC.

_dmarc.yourdomain.com  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com"

Day 25 to 30: reject

After a clean week at full quarantine, switch to reject. Failing mail is now refused outright, which is what stops invoice-fraud messages "from" your domain reaching your customers.

_dmarc.yourdomain.com  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com"

Optional tags worth knowing

• sp=reject applies a policy to subdomains. If you never send from subdomains, add it so nobody can send from invoices.yourdomain.com either.
• adkim=s and aspf=s switch alignment to strict, requiring an exact domain match rather than an organisational match. Leave them relaxed unless you know why you need strict.
• ruf= requests forensic (per-message) reports. Few receivers send them and they may contain personal data; most small businesses skip this tag.

Pitfalls that break legitimate mail

• Forgetting a sender that mails rarely, such as an annual renewal tool or the accounting package that sends statements once a month. Wait for at least one full billing cycle at p=none.
• Website contact forms that send "from" the visitor's address through your server. Change them to send from a fixed address on your domain.
• Forwarding. Mail forwarded by a recipient breaks SPF; DKIM survives, which is why you need DKIM signing on every source, not just SPF.
• Editing the record in the wrong place. It must be a TXT records (short text lines in DNS used for email security) at the _dmarc host, not at the root.

Common questions

Can I go straight from none to reject?

You can, and a brand-new domain with a single sender often does. For any domain that has been in use for a while, the quarantine step catches the sender you forgot without bouncing their mail.

Will p=reject stop mail going to spam?

Not directly. DMARC stops spoofing. Inbox placement depends on reputation and content too, but many receivers treat a domain at p=reject as more trustworthy, and Gmail and Yahoo require a DMARC record for bulk senders.

What if I stop receiving reports after moving to reject?

You should keep receiving them; reports are sent regardless of policy. If they stop, check that the rua mailbox still exists and that its own domain has not been changed.