DMARC Policy Wizard
From p=none to p=quarantine to p=reject without losing real mail: see where your domain is, what has to be true before the next step, and the exact record to publish.
The three DMARC policies
| Policy | Asks receivers to | Move here when |
|---|---|---|
| p=none | Deliver as usual and send reports. | Start here. You learn who sends mail as your domain without changing what arrives. |
| p=quarantine | Treat failing mail as suspicious, usually the spam folder. | Once the reports show every legitimate sender aligned. Mistakes are recoverable: the mail still exists. |
| p=reject | Refuse failing mail during the SMTP session. | After a quiet period at full quarantine. This is the setting that stops spoofing of your domain. |
A message passes DMARC when SPF or DKIM passes and the domain that passed matches the domain in the From header (alignment). That is why “SPF passes” in a header is not enough: a newsletter platform can pass SPF for its own bounce domain and still fail DMARC for yours.
Reading the reports before each step
Aggregate reports (rua=) arrive as zipped XML, usually daily, from Google, Microsoft, Yahoo and other receivers. Upload one to the DMARC report analyzer and sort the sources into three groups:
- Yours and aligned. Your mail platform, passing SPF or DKIM for your domain. Nothing to do.
- Yours but failing. A CRM, invoicing system, helpdesk or newsletter tool that sends as you without DKIM for your domain. Set up DKIM with your domain (or a custom return-path) in that service before you enforce.
- Not yours. Unknown IPs failing both checks. This is the spoofing DMARC enforcement stops.
Move on only when group 2 is empty, and stay long enough to see senders that mail monthly or quarterly. Forwarded mail shows up as a known receiver failing SPF but passing DKIM: that is expected and passes DMARC.
If something breaks
Roll back by publishing the previous record; receivers pick up the change once their cached copy expires, so a short TTL on the _dmarc record during the rollout shortens that wait. Then find the failing source in the next day’s reports, fix its SPF or DKIM, and step forward again. Keeping rua= on at every stage is what makes this possible: without reports you would only hear about lost mail from the people who did not get it. To build a record with other settings, use the DMARC record generator.
Frequently Asked Questions
Which DMARC policy should I use: none, quarantine or reject?
All three, in that order. p=none only asks receivers to send reports, so you learn which services send mail as your domain without affecting delivery. p=quarantine asks them to put failing mail in spam. p=reject asks them to refuse it, which is the setting that actually stops someone sending as your domain. Jumping straight to reject without reading reports is how legitimate invoices, password resets and newsletters disappear.
How long should a domain stay at p=none?
Until the aggregate reports show every legitimate sender passing SPF or DKIM with your own domain, and for long enough to have seen senders that only mail monthly or quarterly, such as invoicing or a quarterly newsletter. For most organisations that is a few weeks to a couple of months. Staying at p=none indefinitely is common and leaves the domain spoofable.
What does pct= do, and do I need it?
pct=25 asks receivers to apply the policy to roughly a quarter of failing messages; the rest get the next weaker policy (RFC 7489, section 6.6.4). It lets you watch the effect of quarantine or reject on a share of mail first. It is optional, receivers sample rather than count exactly, and the DMARCbis revision of the standard replaces it with a testing flag (t=y). Receivers that follow RFC 7489 still honour pct, so publishing it does no harm.
Will p=reject break forwarding and mailing lists?
It can. Forwarding usually breaks SPF, because the forwarding server is not in your SPF record; such mail still passes DMARC if your DKIM signature survives the forward unchanged. Mailing lists that add a subject tag or footer break the DKIM signature too, and those messages then fail unless the receiver trusts the list through ARC. Sign all mail with DKIM using your own domain, and check the reports for forwarded sources before moving to reject.
Is p=none enough for the Gmail, Yahoo and Microsoft sender requirements?
For their bulk-sender rules, a published DMARC record with p=none is the minimum, provided messages pass SPF or DKIM aligned with the From domain. Meeting that minimum is about deliverability. It does not protect the domain against spoofing; only quarantine or reject does that.
Does the wizard store my domain or answers?
No. It reads your public DNS records through the email check API, whose answer is cached for 30 minutes like any other lookup, and the checklist you tick stays in your browser tab. Nothing is saved to an account and nothing is sent anywhere else.