Rolling out DMARC without breaking mail: none to reject
The three DMARC policies — p=none, p=quarantine, p=reject — aren’t really configuration options so much as stages of a rollout. Publishing p=reject on day one is the single most common way a domain accidentally blocks its own mail, because it enforces a policy before anyone has checked whether every legitimate sender is actually passing.
Stage 1 — p=none, at least 2–4 weeks
At p=none, DMARC enforces nothing. It only observes, and every source sending mail as your domain — your email provider, marketing tools, invoicing software, that one internal script nobody remembers setting up — shows up in the aggregate reports. This stage exists purely to build a complete list of legitimate senders and confirm each one is authenticating correctly (see how to read a DMARC aggregate report). Two to four weeks is usually enough to catch anything that doesn’t send daily; a longer window catches monthly or quarterly senders like invoicing runs.
Do not move on while any legitimate sender is still failing. Fix it — add it to SPF, configure DKIM signing, or set up alignment — and keep watching reports until it’s clean.
Stage 2 — p=quarantine
Once every known-legitimate source passes, failing mail can start being treated as suspicious — routed to spam rather than blocked outright. Older guidance suggested ramping into this stage gradually with the pct tag; DMARCbis, the current revision of the DMARC spec, removes pct entirely, so this is a straight move from monitoring to full quarantine. That makes watching reports closely through this stage — and being ready to fall back to p=none if a legitimate sender turns out to be failing — the safety net instead.
Stage 3 — p=reject
This is the enforcement end state: mail that can’t prove it’s from your domain is refused outright, not just spam-foldered. This is what actually stops domain spoofing and look-alike phishing — p=quarantine mail can still occasionally land in a recipient’s inbox depending on their own spam filtering, but p=reject doesn’t leave that door open. Only move here once p=quarantine has run clean for a while, ideally through at least one full business cycle (end of month, invoicing runs, etc.).
The common mistake
Almost every DMARC horror story is a rollout that skipped stage 1, or didn’t wait long enough in it. The policy tag is a two-second DNS change; the work that makes it safe is entirely in the reports you read beforehand. See the guide for the full breakdown of what each policy actually does.