# Moving DMARC from p=none to p=reject: a staged rollout for small businesses

URL: https://iblockspam.com/blog/dmarc-none-to-reject-small-business
Last updated: 2026-10-09
Published: 2026-10-09
Topic: SPF, DKIM & DMARC
Author: iBlockSpam Team

> A staged plan to move DMARC from monitoring to reject without blocking your own mail, including what changes when a filtering gateway sits in front.

## Short answer

Publish p=none with a reporting address and read the reports for at least a month, until every legitimate sender passes aligned SPF or DKIM. Then move to p=quarantine and watch for at least another month before p=reject. Plan on at least two months in total, and longer if you have many sending services.

## Does your DMARC policy protect your inbox or your domain?

DMARC confuses people because it works in two directions at once (our guide to [what DMARC is](https://iblockspam.com/blog/what-is-dmarc) covers the basics):

- **Your policy** (`_dmarc.yourdomain`) tells *other* people's mail servers what to do with mail that claims to be from you but fails. Moving to `p=reject` protects your customers and suppliers from fakes of your domain.
- **Your inbound checks** decide what happens to mail *you* receive that fails *the sender's* DMARC policy. That's done by whatever sits on your MX: Microsoft 365, Google Workspace, or a filtering gateway.

A filtering gateway changes the second job. It doesn't change the first. But it adds two things to get right before you tighten your policy, covered below.

## What does it mean to pass DMARC?

Under [RFC 9989](https://www.rfc-editor.org/rfc/rfc9989.html), a message passes DMARC when **SPF or DKIM passes for a domain that aligns with the From address**. Relaxed alignment (the default) accepts any domain under the same organizational domain, so `mail.example.com` aligns with `example.com`.

Every service that sends mail with your domain in From must achieve this. That includes your mailboxes, but also invoicing tools, website forms, CRMs, newsletters, scanners, and anything that "sends as" you.

## How long should each DMARC stage take?

| Stage | Record | What receivers do with failing mail | Move on when |
|---|---|---|---|
| 1. Monitor | `v=DMARC1; p=none; rua=mailto:dmarc@example.com` | Nothing; they send you reports | All legitimate senders pass for at least a month |
| 2. Quarantine, test mode | `v=DMARC1; p=quarantine; t=y; rua=...` | RFC 9989 receivers: none. Older receivers: quarantine | No new legitimate failures |
| 3. Quarantine | `v=DMARC1; p=quarantine; rua=...` | Junk folder or quarantine | At least a month with no complaints |
| 4. Reject | `v=DMARC1; p=reject; rua=...` | Refuse the message | — keep reading reports |

The free [DMARC Record Generator](https://iblockspam.com/tools/dmarc-generator) builds the record for each stage, with the policy and reporting address you choose.

Stage 2 is optional. Because older receivers ignore `t`, treat it as real enforcement for some of your recipients.

### Step by step

1. **Publish monitoring.** Add the stage 1 record. Use a mailbox you'll actually read, or a DMARC reporting service. If the `rua` address is on another domain, that domain must authorize it with a `example.com._report._dmarc` record. On Microsoft 365, also cover your `onmicrosoft.com` domain, as described in [setting up DMARC in Microsoft 365](https://iblockspam.com/blog/dmarc-setup-microsoft-365).

2. **Fix your outbound path first.** If you send through an outbound relay or smart host (for example, behind a gateway), make sure it DKIM-signs with **your** domain, and that your SPF lists it if it uses your domain as the envelope sender. Test with a message to a Gmail address and read the headers in our [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer).

3. **Read the aggregate reports.** Reports arrive daily, usually as zipped XML ([RFC 9990](https://www.rfc-editor.org/rfc/rfc9990.html)). For each sending source, note whether SPF and DKIM passed and aligned.

4. **Fix each legitimate failure.** Typical fixes:
   - Enable custom DKIM in the sending tool so it signs as `d=yourdomain`.
   - Add the tool's include to SPF, watching the [10-lookup limit](https://iblockspam.com/blog/spf-too-many-dns-lookups).
   - Move bulk tools to a subdomain with their own SPF and DKIM.
   - Retire tools nobody owns.

5. **Recognize forwarding noise.** Mail forwarded by mailing lists or personal forwarding rules often fails SPF and sometimes DKIM. Small volumes from unexpected servers that originally came from you are usually this, not an attack.

6. **Move to quarantine.** Change `p=none` to `p=quarantine`. Keep `rua`. Tell staff to report anything sent that "didn't arrive".

7. **Watch for at least a month.** New failures usually mean a tool someone forgot. Fix it, don't roll back, unless business mail is badly affected.

8. **Move to reject.** Change to `p=reject`. Consider `sp=reject` for subdomains (it inherits `p` if you leave it out) and `np=reject` for subdomains that don't exist.

9. **Keep reading reports.** New tools get adopted. Each one needs aligned DKIM before it goes live.

## How do you read a DMARC aggregate report?

Each report covers a period, usually a day, from one receiver. Inside, each `record` describes a group of messages from one source IP. A trimmed example:

```xml
<record>
  <row>
    <source_ip>203.0.113.40</source_ip>
    <count>212</count>
    <policy_evaluated>
      <disposition>none</disposition>
      <dkim>pass</dkim>
      <spf>fail</spf>
    </policy_evaluated>
  </row>
  <identifiers><header_from>example.com</header_from></identifiers>
  <auth_results>
    <dkim><domain>example.com</domain><result>pass</result></dkim>
    <spf><domain>bounce.mailer.example</domain><result>pass</result></spf>
  </auth_results>
</record>
```

Read it like this:

- **212 messages** came from `203.0.113.40` with From `example.com`.
- DKIM passed for `example.com`, which aligns, so DMARC passed.
- SPF passed, but for `bounce.mailer.example`, which doesn't align. That's why `policy_evaluated` shows `spf` as `fail`.
- `disposition` shows what the receiver did: `none`, `quarantine` or `reject`.

Look up who owns each source IP. Group them by service. Anything you recognize that fails both aligned checks needs fixing before you move on. Anything you don't recognize that fails is probably someone spoofing you, and that's exactly what enforcement will stop.

Raw XML gets tedious quickly. A DMARC reporting service, or a simple script that summarizes reports by source, saves time.

## How do you roll back if legitimate mail fails?

Before each step, note the exact record you're replacing and lower its TTL, for example to 300 seconds, a day ahead. If a business-critical sender starts failing after you tighten the policy, you can put the previous record back within minutes. Fix the sender, then try again. Rolling back is a normal part of a staged rollout, not a failure.

## What changes behind a filtering gateway?

### Inbound: make sure your mailbox platform sees the real sender

When your MX points to a filtering gateway, Microsoft 365 or Google Workspace receives mail from the gateway, not from the original sender. Without extra configuration, they may evaluate SPF against the gateway's IP and get misleading results.

- **Microsoft 365:** configure an inbound Partner connector for the gateway and enable [Enhanced Filtering for Connectors](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors). Microsoft says this preserves the original source IP and lets it use explicit SPF, DKIM and DMARC.
- **Google Workspace:** add the gateway's addresses as an [inbound gateway](https://knowledge.workspace.google.com/admin/gmail/advanced/set-up-an-inbound-mail-gateway) so Gmail looks past them.

This matters for inbound DMARC checks, not for your own policy. But it's the most common reason people think "DMARC is broken" after adding a gateway.

### Outbound: one more sender to align

If your outgoing mail also goes through the gateway's relay, that relay becomes a sender in your DMARC reports. It must sign with your domain's DKIM key. Add it before stage 3.

### Gateway-generated mail

Notification mail, such as quarantine digests, may come from the filtering service's domain or from yours. Check a sample's headers. If it uses your domain in From, it must pass DMARC like any other sender.

## What about subdomains and parked domains?

Your policy covers subdomains too, unless they publish their own record. Before moving to `reject`, check subdomains that send mail, such as `news.example.com` or `support.example.com`, appear in your reports and pass. If you own extra domains that never send email, such as old brand names or typo-protection domains, publish `v=spf1 -all`, a Null MX record (`MX 0 .`) and `p=reject` on each one straight away. They need no staged rollout because no legitimate mail should ever come from them.

## What do Gmail, Yahoo and Microsoft require?

[Google](https://support.google.com/mail/answer/81126) (close to 5,000 messages a day) and [Yahoo](https://senders.yahooinc.com/best-practices/) (bulk senders, no published threshold) require bulk senders to publish DMARC, at least `p=none`, with aligned SPF or DKIM. Microsoft announced similar requirements for high-volume senders to Outlook.com consumer addresses from May 2025. Most small businesses are below these thresholds, but `p=none` is the floor, not the goal.

## How iBlockSpam helps

iBlockSpam filters inbound mail at the MX, with phishing and spoofing protection. Our guided setup covers the Microsoft 365 Partner connector with Enhanced Filtering for Connectors, and the Google Workspace inbound gateway. Our outbound relay DKIM-signs your mail (500 messages per month included). The [DMARC Checker](https://iblockspam.com/tools/dmarc-checker) validates your record at each stage, and domain monitoring alerts you if your DMARC record changes. Our [DMARC monitoring](https://iblockspam.com/features/dmarc-monitoring), included with every plan, collects your aggregate reports and tells you when it's safe to tighten your policy.

## Next steps

1. Check your current record with the free [DMARC Checker](https://iblockspam.com/tools/dmarc-checker).
2. If you don't have one yet, build a `p=none` record with reporting using the [DMARC Record Generator](https://iblockspam.com/tools/dmarc-generator).
3. Load your first aggregate reports into the [DMARC Report Analyzer](https://iblockspam.com/tools/dmarc-report-analyzer) and start your sender list.

Related: [DMARC quarantine vs reject](https://iblockspam.com/blog/dmarc-quarantine-vs-reject) explains the last step in detail, and [DMARC policy not enabled](https://iblockspam.com/blog/dmarc-policy-not-enabled) covers the warning many domains see first.

Browse our other [SPF, DKIM and DMARC guides](https://iblockspam.com/blog/topic/authentication).

## Frequently asked questions

### How long should I stay at p=none?

Until your reports show every legitimate sender passing. Plan on at least a month, even for a small business with a handful of tools. RFC 9989 warns it can take many months for complex organizations. Don't move on a calendar date; move on evidence.

### Can I still use pct=10 to roll out gradually?

RFC 9989 removed pct and added t=y (test mode) instead. Receivers that still follow RFC 7489 may honor pct, and newer ones may honor t. Neither is guaranteed, so treat each stage as if it applies to all mail.

### Will p=reject stop phishing emails reaching my staff?

Only ones that forge your exact domain, and only at receivers that enforce DMARC. It doesn't stop look-alike domains or compromised third-party accounts. Inbound filtering handles those.

### Does my filtering gateway check DMARC on inbound mail?

A properly configured gateway checks the original sender's SPF, DKIM and DMARC on mail coming to you. Your own DMARC policy is about mail other people receive from you, which is a separate question.

## Sources

- [RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)](https://www.rfc-editor.org/rfc/rfc9989.html)
- [RFC 9990: DMARC Aggregate Reporting](https://www.rfc-editor.org/rfc/rfc9990.html)
- [RFC 7489: DMARC (obsoleted by RFC 9989)](https://www.rfc-editor.org/rfc/rfc7489.html)
- [Gmail Help: Email sender guidelines](https://support.google.com/mail/answer/81126)
- [Yahoo Sender Hub: Sender best practices](https://senders.yahooinc.com/best-practices/)
- [Microsoft Learn: Set up DMARC to validate the From address domain](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configure)
- [Microsoft Learn: Enhanced Filtering for Connectors in Exchange Online](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors)
- [Google Workspace Admin Help: Set up an inbound mail gateway](https://knowledge.workspace.google.com/admin/gmail/advanced/set-up-an-inbound-mail-gateway)

## Free tools for this guide

- [BIMI Checker](https://iblockspam.com/tools/bimi-checker): Check your BIMI record, logo and certificate URLs, and the DMARC policy BIMI needs.
- [DMARC Report Analyzer](https://iblockspam.com/tools/dmarc-report-analyzer): Read DMARC aggregate reports (XML, gzip or zip): see who sends as your domain and what fails — runs in your browser.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [DMARC Record Generator](https://iblockspam.com/tools/dmarc-generator): Build a DMARC record with the right policy, reporting and alignment settings.

---

Source: iBlockSpam, https://iblockspam.com/blog/dmarc-none-to-reject-small-business (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt