Migrating the DMARC policy: from p=none to p=reject

Jumping straight to p=reject costs legitimate messages. A safe migration runs in three stages, each one only after checking the reports.

Recommendations lead to p=reject in stages.

Stage 1: p=none

The start is pure observation. p=none does not change delivery and collects reports through the rua address. Two to four weeks are usual, until all legitimate sending sources authenticate cleanly in the aggregate reports.

Stage 2: p=quarantine

Once the sources are known and aligned, p=quarantine follows. Unauthenticated messages land in the recipient's spam folder. Through the pct tag the share can be raised slowly, for instance pct=25, then pct=50, up to pct=100. An overlooked sender thereby affects only part of the messages.

Stage 3: p=reject

If the pass rate stays stable under quarantine as well, p=reject follows. Spoofing is now rejected hard. Conbool recommends this step automatically as soon as the pass rate has been stable at a high level for 14 days. Only with p=reject enforced is the foundation for BIMI laid, the display of the verified brand logo at the recipient.

Mind subdomains and pct

Without the sp tag, subdomains inherit the policy of the main domain. For subdomains with a mail flow of their own an explicit sp rule is advisable. If the pass rate drops after a raise, the policy is to be taken back temporarily and the cause checked in the reports, usually a new or misconfigured sending source.

Next

The tags in detail are described in creating a DMARC record in DNS. How alignment comes about at all is shown in SPF and DKIM as the foundation of DMARC. The overall picture is given by the DMARC Reports category and the solution page DMARC email authentication.