DMARC: From p=none to p=reject, Safely

What DMARC actually does

SPF answers 'is this sending IP authorised?' DKIM answers 'has this message been tampered with since it was signed?' DMARC is the glue: it requires that at least one of those checks pass AND that the authenticated identity aligns with the From: header domain the user sees. That alignment step is the part that defeats spoofing - an attacker who owns attacker.com can sign their mail with DKIM and send from a permitted IP, but they cannot align either signature with your From: domain.

DMARC then publishes a policy - none, quarantine, or reject - telling receiving servers what to do when alignment fails. And it publishes a reporting address so you see what is happening.

Stage 0 - Publish p=none with reports

Ship DMARC in monitor mode first. p=none applies no enforcement but mandates reports. Once you have two to four weeks of aggregate reports, you know every system that sends from your domain.

_dmarc.example.com.  IN  TXT  "v=DMARC1; p=none; rua=mailto:[email protected]; adkim=r; aspf=r; pct=100"

Stage 1 - Inventory every sender

Your first two weeks of DMARC reports will surprise you. They will list marketing platforms you forgot about (Mailchimp, Klaviyo, Customer.io), transactional senders (SendGrid, Postmark, SES), HR and payroll systems, expense tools, monitoring alerts - every system that was configured years ago to send 'from' your domain.

For each sender, answer:

1. Is this a legitimate sender we still use? If no - remove the DNS/SPF reference and rotate any keys.
2. Does it sign outbound mail with DKIM on our domain? If not, configure DKIM (every major platform supports it).
3. Is its sending IP listed in our SPF? If not, add it or (better) add its dedicated SPF include.
4. Does the From: header match our aligned domain? Some platforms send From: our-domain but route the envelope through theirs - alignment fails.

Stage 2 - DKIM on every legitimate sender

DKIM is the more forgiving of the two authentication mechanisms - it survives forwarding, mailing lists often preserve it, and it provides an aligned identity without requiring you to declare every IP. Aim for 100% DKIM coverage before tightening the DMARC policy.

selector1._domainkey.example.com.  IN  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."

Rotate DKIM keys at least annually. 2048-bit RSA is the current minimum; Ed25519 is supported by a growing share of receivers and produces smaller DNS records.

Stage 3 - SPF cleanup

SPF has a 10-DNS-lookup limit. Every include: counts. Every a and mx counts. Exceed ten and the record evaluates to permerror, which DMARC treats as a fail. An SPF record accumulated over years almost certainly exceeds the limit.

dig +short TXT example.com | grep spf1
# Then walk each include: recursively and count lookups.
# Tools: spflint, dmarcian SPF Surveyor, MxToolbox SPF check.

Options to stay under 10:

• Retire unused includes (expect to find 3–5 stale ones).
• Flatten with a hosted SPF flattener (keeps your record under 10 by resolving and caching the IPs at query time). Caveat: the flattener becomes critical infrastructure.
• Split senders across subdomains (marketing.example.com for Mailchimp, transactional.example.com for SendGrid) - each subdomain gets its own budget.

Stage 4 - Ramp through p=quarantine

Use pct= to apply the policy to a fraction of failing mail. Start at pct=10 - 10% of alignment failures go to quarantine, 90% go through. Check reports. Ramp up over weeks.

; Stage 4a
_dmarc  TXT  "v=DMARC1; p=quarantine; pct=10; rua=mailto:[email protected]; adkim=r; aspf=r"

; Stage 4b
_dmarc  TXT  "v=DMARC1; p=quarantine; pct=50; rua=mailto:[email protected]; adkim=r; aspf=r"

; Stage 4c
_dmarc  TXT  "v=DMARC1; p=quarantine; pct=100; rua=mailto:[email protected]; adkim=r; aspf=r"

Stage 5 - Promote to p=reject

Once you have been on p=quarantine; pct=100 for at least two weeks with no new senders appearing in reports and no complaints from users, promote to p=reject. You can ramp through pct= again if you want a safety margin, but the conservative path is: if quarantine was clean, reject will be too.

_dmarc.example.com.  IN  TXT  "v=DMARC1; p=reject; rua=mailto:[email protected]; adkim=s; aspf=s; pct=100"

Forwarding, mailing lists, and the DMARC failure modes you will see

• Traditional mailing lists rewrite the From: header to the list address - that removes alignment with your domain and avoids DMARC failure. Good.
• Forwarding addresses (autoforward from one mailbox to another) often do not rewrite headers, so SPF fails at the second hop. DKIM usually survives - which is why DKIM coverage is non-negotiable.
• ARC (Authenticated Received Chain) is the protocol for forwarders to signal "I received this, it was aligned when I got it." Major providers honour ARC; it is the fix for legitimate forwarding breaking DMARC.
• Newsletter platforms that send "on behalf of" your From: address without DKIM alignment will fail DMARC. Configure DKIM on those platforms or migrate.