Guides

Move to p=reject without losing mail

Last updated 2026-09-07

Your domain has sat at p=none for months, the reports look fine, and the move to p=reject still feels like a cliff. This is the checklist I run before every step, the one word each step changes, and the way back when a step catches mail you wanted delivered.

Is it safe to go to p=reject today? Only if every check below passes against the last four weeks of aggregate reports. One check you cannot answer means you stay where you are for another week.

The six checks, before any step

1. Every source above 1% of your volume is identified and aligned. You can say what it is, and its mail passes DMARC on SPF or DKIM with the domain matching. How alignment works covers the matching part.
2. Aligned mail is above 98% of volume for two weeks running. For the step to reject, 99%. Read the number from the reports, not from a checker; a checker reads your record and cannot see your mail.
3. DKIM carries most of the passes. At least four in five passing messages pass on aligned DKIM. SPF fails the moment a message is forwarded and DKIM survives it, so a domain passing on SPF alone is far more fragile at enforcement than its pass rate says.
4. SPF is at eight lookups or fewer. The limit is ten, and a domain at nine is one new include away from every sender failing at once. The lookup guide has the count and the fix.
5. Your monthly senders have run inside the window. Invoicing, payroll, the quarterly statement. Four weeks of reports is the shortest window that sees a monthly sender once.
6. Reports are still arriving. A week with no report from Google or Microsoft is missing evidence, and a quiet week is never a pass.

Reading an aggregate report shows where each of these numbers sits in the XML. If you have never opened one, start there and come back.

Step 1: none to quarantine, one word

Before you publish it, drop the TTL on the _dmarc record to 300 seconds. The TTL is how long a receiver caches your record, so it is also how long a rollback takes to reach them. Five minutes is a rollback you can do on a phone; a day is not.

Then change none to quarantine and change nothing else. Leave sp= alone in this step. Moving the subdomain policy at the same time doubles what can break and halves your chance of knowing which change did it.

At quarantine, a failing message goes to the recipient's spam folder. That is where you find out about the sender you missed: someone at a partner says your invoice went to junk, and the message is still there to prove it. Watch the helpdesk as closely as the reports for two weeks.

Step 2: quarantine to reject, the same word again

Run the six checks again with the tighter pass rate. Then change quarantine to reject. From here a failing message is refused during delivery, the sending server gets a 550 5.7.1 bounce, and you get nothing. Keep rua= for as long as the domain exists, because the reports are the only instrumentation left.

Moving back: what a rollback does and does not undo

Put the previous policy back in the record. With a 300 second TTL every receiver is reading the old policy within five minutes, and no more mail is refused. Mail already rejected is gone; the sender has a bounce, and asking them to resend is the whole remedy. Mail quarantined is in a spam folder and can be pulled out.

The signal to roll back is in the reports: a sender you have marked as your own whose failing share rises after the step. Fix that sender at p=none or p=quarantine, wait for two clean weeks, and take the step again. Moving back is part of the method. The failure is the domain that sits at quarantine for a year because nobody dared, since it has taken the delivery risk and collected none of the protection.

Doing this by hand, and doing it with us

By hand, this is a spreadsheet with one row per sender, a column for each check, and a calendar reminder every Monday to fill it in from the week's reports. Cloudflare's free DMARC Management parses the reports for you if your DNS is there, and it is a sincere first choice for a single domain on Cloudflare.

On the paid plans, guided enforcement runs these checks daily against your reports, sizes the next step by how many messages it could cost you, and mails you the proposal with the evidence. You approve it from a link in the mail. For three days after we publish it we read the reports, and if a sender you have marked as yours starts failing, we move the record back and email you what happened. Hosted DMARC is what lets us publish and revert the record: you point _dmarc at us once, and every step lands within a quarter hour.

Point your rua= tag at a mailbox someone reads. We parse that XML and mail you the senders that used your domain and whether each one passed. Paid plans add an alert the day a new sender first shows up failing. One free domain, no card.

DomainCanary is a DMARC monitoring service that protects your domain from email spoofing without blocking your own mail.