By Dave Kowalski · Network engineer with 27 years in email infrastructure and DNS. Ran mail systems for enterprises and mid-size companies since the late 90s.
DMARC: The Slow Burn From p=none to p=reject Without Breaking Anything
A few years back I was helping a company that kept getting phishing complaints. Someone was spoofing their domain and sending fake invoices. They had no idea how many senders were out there using their name. I set up DMARC with p=none and a report address. Within a week we had 47 different IPs sending email claiming to be from them. About half were unauthorized.
DMARC publishes a policy that tells receiving servers what to do with email that fails SPF or DKIM. But more importantly, it gives you visibility into every source sending email on your behalf. Before DMARC, if someone spoofed your domain, you'd never know. After DMARC, you get daily XML reports showing every IP, whether it authenticated, and what the receiver did with it.
I've seen DMARC save companies that were getting spoofed daily. I've also seen it break email for companies that rushed straight to p=reject. The phased approach is the only safe way.
The Three Policies
p=none (Data Collection)
This is your starting point. It tells receivers: deliver everything, but send me reports. You're not blocking anything. You're gathering intelligence.
The natural instinct is to skip this phase. Don't. You don't know who's sending email from your domain. None of us do until we see the reports.
p=quarantine
Emails that fail authentication go to the spam folder. This is your testing ground. Run it for 2-4 weeks and watch for false positives.
p=reject
Hard block. Failed authentication means the email is rejected at the SMTP level. The sending server gets a bounce. The recipient never sees it. This is your end state.
The DMARC DNS Record
DMARC is published as a TXT record at _dmarc.yourdomain.com.
_dmarc TXT "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; pct=100"
Tags Breakdown
| Tag | Required | What It Does |
|---|---|---|
| v | Yes | Version tag. Must be DMARC1. |
| p | Yes | Policy for the domain. none, quarantine, or reject. |
| sp | No | Policy for subdomains. Inherits from p if not set. |
| rua | No | Aggregate report URI. The email address for daily XML reports. |
| ruf | No | Forensic report URI. Detailed failure reports (rarely used in practice). |
| pct | No | Percentage of failing emails to apply the policy to. Defaults to 100. |
| adkim | No | DKIM alignment: r (relaxed) or s (strict). Defaults to r. |
| aspf | No | SPF alignment: r (relaxed) or s (strict). Defaults to r. |
The Implementation Plan
Phase 1: Deploy p=none
Publish this record:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; pct=100
The rua address needs to accept external email and not have DMARC filtering itself (or it will create a loop). I recommend setting up a dedicated mailbox on a separate domain or using a DMARC reporting service.
Wait at least two weeks. Longer is better. You need enough data to see patterns.
Phase 2: Read the Reports
DMARC reports are XML files. They look like gibberish if you open them raw. You need a parser. Our DMARC Lookup tool checks your published record. For the actual report analysis, there are free parsers online that give you dashboards.
In the reports, look for:
Phase 3: Fix Issues
For each unrecognized source, determine if it's legitimate. Check with your team. Did Marketing set up a new email tool? Did Engineering add a new transactional email provider?
For legitimate senders that fail authentication:
Phase 4: Move to p=quarantine
v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; pct=100
Run this for 2-4 weeks. Monitor the reports for legitimate emails going to spam. If you see any, fix the underlying SPF or DKIM issue before moving to reject.
Phase 5: Move to p=reject
v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com; pct=100
At this point, email that fails SPF and DKIM is rejected. Spoofing attempts bounce. Legitimate email passes. You're protected.
Alignment: Where Most People Get Confused
DMARC requires the domain in the From header to align with the domain authenticated by SPF or DKIM.
SPF alignment: The domain in the Return-Path (envelope sender) must match the domain in the From header.
DKIM alignment: The domain in the d= tag of the DKIM signature must match the domain in the From header.
Relaxed vs Strict
Relaxed means the organizational domain must match. So if your From address is user@example.com and the SPF check runs against mail.example.com, that's aligned (because both are under example.com).
Strict means exact match. mail.example.com does not align with example.com. Your From address must match the authenticated domain exactly.
Almost everyone should start with relaxed. Strict only makes sense if you have a very specific security requirement.
Using the Tools
DMARC Generator
Our DMARC Generator builds your DMARC record. Select your policy, enter your report email, pick your alignment mode, and copy the record to DNS. It validates the syntax before showing you the output.
Domain Health Check
The Domain Health tool checks SPF, DKIM, and DMARC in a single query. Run this weekly during your DMARC rollout to catch issues before they cause problems.
Header Analyzer
When you get a false positive, inspect the raw headers. The Header Analyzer parses the Authentication-Results section and shows you exactly which check failed and why.
Common Problems
| Problem | What's Happening |
|---|---|
| Legitimate emails being quarantined or rejected | A legitimate sender doesn't pass SPF or DKIM. Check your DMARC reports, find the source, add it to your SPF record or configure DKIM for it |
| DMARC reports not arriving | The rua email address may be rejecting DMARC report emails, or the report server may not have permission to send to it. Check the mailbox logs |
| DMARC fails even though SPF and DKIM pass | Check domain alignment. The Return-Path or d= domain needs to match the From header domain (or be a subdomain with relaxed alignment) |
| Reports show hundreds of spoofed sources | Your domain is actively being phished. Move to p=reject as quickly as you can verify your legitimate senders |
| Subdomain email failing DMARC | You need the sp tag. Add sp=reject to cover subdomains explicitly |
Quick Reference
Phase 1: v=DMARC1; p=none; rua=mailto:you@yourdomain.com; pct=100
Phase 2: v=DMARC1; p=quarantine; rua=mailto:you@yourdomain.com; pct=100
Phase 3: v=DMARC1; p=reject; rua=mailto:you@yourdomain.com; pct=100
Each phase should run at least 2 weeks. Some organizations need months at p=none to identify all their senders. Take the time you need.
Verify Your Setup
Use the DMARC Lookup tool to verify your published record. Run a Domain Health Check to see your full authentication profile. If both look good, you're on the right track.