Move DMARC from none to reject without losing mail

The short version

• Stage 1, monitor: v=DMARC1; p=none; rua=mailto:dmarc@yourbusiness.com (the address is an example).
• Stage 2, quarantine: change p=none to p=quarantine once every real sender passes.
• Stage 3, reject: change it to p=reject once quarantine has run cleanly.
• Google suggests at least a week at each stage. Many small businesses take a few weeks to find every sender.
• Set up SPF and DKIM at least 48 hours before you start.

What are the steps?

Before you start

Make sure SPF and DKIM are in place for your mailbox provider. See the SPF record for Microsoft 365 or Google Workspace and turning on DKIM. Google’s DMARC page says to let them run for at least 48 hours before adding DMARC.

Decide where reports go. Google recommends a dedicated mailbox, a group, or a DMARC reporting service rather than a personal inbox, because large senders get many reports a day. If the address is on a different domain, such as a reporting service’s, that domain has to publish a record agreeing to receive them. Good services do this for you.

Stage 1: monitor

1. At your DNS provider, add a TXT record.
   • Host: _dmarc (some providers want _dmarc.yourbusiness.com)
   • Value: v=DMARC1; p=none; rua=mailto:dmarc@yourbusiness.com
2. Check it with our email deliverability checker.
3. Wait for reports. Google says they’re usually sent once a day by each provider that received your mail.

At p=none, nothing is blocked or moved to spam because of DMARC. You’re only collecting evidence.

Diagram: the three DMARC stages, with example records and when to move on. The reporting address is an example. Based on Google Workspace Admin Help (October 2026).

Stage 2: quarantine

Move on when the reports show every service you recognize passing DMARC, through SPF or DKIM lined up with your domain, for at least a week, and you’ve looked up any unknown failing sources rather than assuming they’re spoofing. Check your own list too: a tool that sends only a few times a year may not show up in a week of reports, and not every receiver sends reports. Google’s rollout page suggests at least one week of monitoring. Then edit the same record:

v=DMARC1; p=quarantine; rua=mailto:dmarc@yourbusiness.com

Receivers are now asked to treat mail that fails DMARC as suspicious, which usually means the spam folder. The standard leaves the final handling to each receiver. Keep reading reports. If a real sender shows up failing, fix it or step back to p=none while you do.

Stage 3: reject

When quarantine has run cleanly, typically a few weeks with no legitimate mail failing, change it again:

v=DMARC1; p=reject; rua=mailto:dmarc@yourbusiness.com

Receivers are now asked to refuse failing mail. Many large providers do, but the DMARC standard (RFC 9989, sections 5.4 and 7.4) leaves the final decision to each receiver, and some quarantine it instead. That’s the strongest protection against someone sending as your domain, and it’s what BIMI and Microsoft’s sender policy recommend.

What about pct, sp and the new standard?

Older guides, and Google’s own pages, use pct to apply a policy to a share of your mail at first, such as pct=5. RFC 9989, the new DMARC standard published in May 2026, removes pct and adds a t (testing) tag in its place. Receivers are moving to the new rules at different speeds, so some will honor pct and some will ignore it.

Our advice: don’t rely on pct or t to soften a policy. Rely on the reports. Only tighten when nothing legitimate is failing, and you won’t need a partial policy.

Two other tags are worth knowing:

• sp sets a separate policy for subdomains. Without it, subdomains follow your main policy. That’s usually what you want.
• adkim and aspf set alignment to relaxed (the default) or strict. Relaxed lets news.yourbusiness.com count as matching yourbusiness.com. Leave them at the default unless you have a reason.

Why does this matter?

A DMARC record is required for bulk senders to Gmail, Yahoo and Outlook.com. Even p=none meets that requirement; see the bulk-sender rules. But p=none doesn’t ask receivers to act on fake mail in your name. Only quarantine and reject do. And the reports are the most reliable way to discover the services sending as your domain, including ones you’d forgotten, though not every receiver sends them.

What are the common mistakes?

• Going straight to reject. The invoice tool, the website form or the booking system nobody listed gets blocked, and you hear about it weeks later.
• Parking at p=none forever. The record exists, reports pile up unread, and spoofing still works.
• Two DMARC records. Only one is allowed. Edit the one you have.
• Typos. DMARC is fussy. Each tag ends with a semicolon, v=DMARC1 comes first, and the address needs mailto:.
• Adding a new tool after reject. Its mail fails from day one. Set up its DKIM before it sends a single message.
• Forgetting forwarding. Some forwarded mail fails SPF. DKIM usually carries it through, which is another reason to have DKIM on everything.

What if real mail starts failing?

1. Step back one stage right away: reject to quarantine, or quarantine to none.
2. Find the failing source in the reports. See reading DMARC reports.
3. Fix it with DKIM for your domain, an SPF include, or by sending that mail through your main provider.
4. Watch for a clean week, then tighten again.

How long does it take?

Each record change takes minutes and costs nothing. The calendar is the slow part: at least a week at p=none, often a few, then a few weeks at quarantine. A DMARC reporting service is optional and has its own pricing. The free alternative is reading the raw files yourself.

How does E-3 handle this?

DMARC is one of the records we look at whenever a client’s mail has trouble. Moving a policy to quarantine or reject changes what happens to a business’s mail, so it’s a decision to make with the reports in front of you, not a default.

Related questions

• How do I read DMARC reports?
• Someone is sending fake emails as me. What do I do?
• What does DMARC mean?
• Do the bulk-sender rules apply to me?
• Back to the complete guide to business email that lands

Sources

1. Set up DMARC (Google Workspace Admin Help)
2. Recommended DMARC rollout (Google Workspace Admin Help)
3. Set up DMARC to validate email in Microsoft 365 (Microsoft Learn)
4. RFC 9989: Domain-based Message Authentication, Reporting, and Conformance (DMARC) (IETF, May 2026)