Dmarc Overview

From monitoring to enforcement

This is the single rollout plan to use for any domain. It moves a domain from p=none to p=quarantine to p=reject in stages, with a check before each move.

Overview

Stage Policy Typical duration Goal
1. Monitor p=none 2 to 4 weeks, longer if you send monthly or quarterly Discover every sender
2. Fix p=none As long as needed Get every legitimate sender to pass and align
3. Quarantine, gradual p=quarantine; pct=10, then 25, 50, 100 2 to 4 weeks in total Test with a safety net
4. Reject, gradual p=reject; pct=10, then 25, 50, 100 2 to 4 weeks in total Block spoofing
5. Maintain p=reject Ongoing Catch new senders and breakage

Note: durations are guidance, not product limits. Choose a monitoring period that covers your longest sending cycle, for example a monthly newsletter or a quarterly invoice run.

Stage 1: Monitor

  1. Publish p=none with your DMARC+ report address. See Set up DMARC for the first time.
  2. Leave it for at least two weeks.
  3. Do not change other records yet.

Exit criteria

  • Reports have arrived from the major receivers you expect.
  • You have covered at least one full cycle of your slowest recurring send.

Stage 2: Fix senders

Open DMARC+ > Aggregate Reports and list the sending IPs and sources for the domain.

For each source decide:

Finding Action
Legitimate and passing DMARC Nothing
Legitimate but failing Fix SPF or DKIM alignment for that service (see third-party senders)
Unknown Investigate: an unused tool, a partner, or spoofing
Clearly not yours Leave it; enforcement will stop it

Exit criteria

  • Every legitimate source passes DMARC in the Aggregate Reports.
  • Remaining failures are unknown or malicious sources you are happy to block.
  • The SPF record has fewer than 10 lookups and a single record.

Tip: there is no fixed pass-rate target. A common rule of thumb is to require very high pass rates for your own known volume. Judge by sources, not only the percentage.

Stage 3: Quarantine

  1. Change the policy to quarantine with pct=10.
  2. Wait a few days. Watch the Dashboard and Aggregate Reports for new failures from legitimate mail.
  3. Raise pct to 25, 50, then 100, waiting a few days at each step.

Exit criteria for each step

  • No legitimate sender begins to fail.
  • Support has received no reports of missing mail.

Stage 4: Reject

Repeat the same steps with p=reject, starting again at pct=10.

Exit criteria

  • pct=100 for at least two weeks with no legitimate failures.

Note: some organizations stay at quarantine permanently for a domain where a stray sender is hard to control. Reject is the strongest setting but not mandatory.

Stage 5: Maintain

  • Review the Dashboard weekly or use the weekly report.
  • Add every new mail service to SPF or DKIM before it goes live.
  • Set the subdomain policy sp=reject once you know subdomains are clean.
  • Re-check after mail migrations and DNS changes.

How to change the policy

  • Managed record: change the policy in Manage > Managed DMARC and publish. No DNS change is needed if the domain already points at the managed record.
  • Self-managed record: generate a new record in the DMARC Generator and replace the TXT value.

Allow for DNS caching. Old values can persist until the record's TTL expires.

What to watch after each change

Signal Where Meaning
Rise in "Non-Compliant" mail Dashboard Receivers are acting on failures. Check who.
A legitimate service in the failing list Aggregate Reports Fix alignment before raising the policy
Sudden drop in volume Dashboard Reports may have stopped. See Troubleshooting.

Rolling back

If legitimate mail is blocked, lower the policy to the previous step or none, fix the sender, and start again from the failed stage.

Tip: do a rollback drill on paper before you start. Know who edits DNS and how long a change takes to appear.