Get to p=reject
without breaking mail.

A DMARC record tells receiving servers what to do with mail that claims to be from your domain but fails authentication, and it has three settings. p=none is monitoring only: nothing is blocked, but you start receiving reports of who is sending as you. p=quarantine sends failing mail to spam. p=reject refuses it outright — the setting that actually stops spoofing and the one enforcement means.

The recommended progression runs through all three in sequence: monitor to learn, quarantine to contain, reject to enforce. That order isn’t bureaucracy — it’s what lets you catalogue your real email flows and fix alignment before any failing mail is acted on. The instinct to skip to reject is exactly what blocks the senders you forgot about, which is why a careful deployment treats each stage as a checkpoint rather than a formality.

Publishing a DMARC record takes minutes. Reaching enforcement safely takes weeks to months, and the gap between those two facts is where most attempts fail. A careful ramp from monitoring to reject runs roughly 90 to 120 days for a typical organisation — longer for complex environments with many business units — because the monitoring phase has real work in it: reviewing aggregate reports, cataloguing every sending source, and authenticating each one. Skipping or shortening that phase is the single most common cause of enforcement failures.

The numbers tell the story. Only around 28.5% of domains that publish a DMARC record ever reach p=reject; the rest stall at none, getting the reports but never the protection, because the leap to enforcement felt too risky to make blind. A domain isn’t ready to advance until every legitimate sender is identified and passing alignment consistently — and knowing when you’ve actually reached that point, rather than guessing, is most of what this service provides.

The first reason is security. DMARC at reject is the control that stops anyone spoofing your exact domain in phishing and business-email-compromise attacks — the technique behind the large majority of breaches, which still begin with a convincing fake email. Without enforcement, an attacker can send mail that appears to come from your domain and receivers will accept it; with reject, those forgeries are refused at the door. It’s also increasingly a hard requirement — security frameworks, customers and cyber insurers now ask for DMARC enforcement as a condition rather than a nicety.

The second is deliverability. Since 2024, Google and Yahoo require a published DMARC policy alongside aligned SPF and DKIM for anyone sending more than 5,000 messages a day to their users, and authentication is the foundation everything else in placement rests on. Getting DMARC right doesn’t just protect your brand from misuse; it keeps your legitimate mail accepted under rules that are only tightening. The two payoffs come from the same work done once, correctly — which is part of why DMARC is unusual: the security control and the deliverability requirement are satisfied by the identical alignment effort, so a domain that authenticates properly is both harder to forge and more trusted by the inboxes it sends to.

We’ll be plain about it: publishing a DMARC record costs nothing, and our record generator, checker and report reader let you do the mechanical parts yourself for free. If your environment is small and your SPF and DKIM are already right, you genuinely can finish the ramp on your own, and we’ll say so rather than invent complexity.

What you pay for is the judgement around the tooling: combing the reports to find every system sending as you, getting alignment right on third-party tools that each authenticate differently, deciding when the pass rates justify advancing the policy, and carrying the ramp to reject without a single legitimate stream being caught. That work is most valuable exactly when it’s hardest — many senders, multiple teams, a tangle of subdomains — which is also when doing it wrong is most expensive. If your case is simpler than that, the honest answer is the free tools, and you’ll get it.

Monitor (p=none). The longest and most important stage. Reports flow in while nothing is blocked, and the work is reviewing them to catalogue every legitimate sender and get SPF and DKIM aligned for each. The three numbers that matter here are your total sending sources, your alignment pass rate, and the count of unidentified senders — and you don’t leave this stage until the unknowns are resolved and the pass rate stays consistently high across every receiver that reports back.

Contain (p=quarantine). The first stage with teeth. Rather than flip it on for all mail at once, we use the percentage tag to apply quarantine to a small share first — often ten percent — and raise it toward a hundred as the reports keep confirming legitimate mail is passing. Any surprise sender that surfaces here lands in spam rather than being lost, which is the safety margin the ramp is designed to give.

Enforce (p=reject). The destination. Reject only goes live once the reports show your real mail fully aligned, at which point forgeries are refused outright while everything legitimate continues untouched. Subdomain policies and alignment strictness are set deliberately at this point, and the non-sending domains get their own reject. After enforcement, BIMI becomes available as the visible payoff. And enforcement isn’t quite the end: new tools get added, vendors change, and a domain that stops being watched can drift back out of alignment over time — which is why the documented sender list we hand over matters, and why some senders keep the policy under ongoing watch rather than setting it and forgetting it.

The failure modes are consistent. Jumping straight to reject before discovery is the big one — it’s precisely how a forgotten sender gets silenced the day you enforce, the situation the DMARC reject blocking mail fix exists to undo. An SPF record grown past its ten-lookup limit fails silently and drags alignment down with it. DKIM that signs but doesn’t align to the visible From domain passes the wrong test. And leaving parked domains unprotected hands attackers a free identity to spoof.

None of these throw an obvious error — they show up as legitimate mail quietly failing or as a domain still spoofable after you thought it was locked down. Working through the staged ramp with the reports open is what turns those silent failures into visible, fixable findings before enforcement makes them costly. The underlying mechanics, if you want them, are in the SPF/DKIM/DMARC documentation.