September 14, 2026•By Sarah Jenkins, Principal Architect

DMARC p=reject Migration Playbook: Moving Safely from p=none Without Dropping Valid Mail

The Trap of Indefinite Monitoring (p=none)

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is the gold standard for stopping email spoofing. Yet, over 70% of organizations with DMARC records remain stuck at `p=none`.

While `p=none` provides visibility via aggregate XML reports, it provides zero protection against spoofing

The hesitation is understandable: deploying `p=reject` prematurely can break marketing emails, CRM notifications, or invoices sent by third-party SaaS vendors.

The 4-Phase Migration Roadmap

Phase 1: Discovery & Shadow Auditing (`p=none`)

Deploy `v=DMARC1; p=none; rua=mailto:dmarc-rua@yourdomain.com`.

Ingest aggregate XML reports for 30 to 45 days.

Identify all legitimate sending services (Salesforce, Zendesk, Google Workspace, Mailchimp).

Phase 2: Remediate Alignment Gaps

Configure custom DKIM selectors and SPF includes for every approved third-party sender.

Eliminate unaligned third-party mailings where the header `From:` does not match the envelope sender domain.

Phase 3: Gradual Quarantine (`p=quarantine`)

Introduce quarantine enforcement gradually using the `pct` (percentage) tag:

Week 1: `v=DMARC1; p=quarantine; pct=25; rua=...`

Week 2: `v=DMARC1; p=quarantine; pct=50; rua=...`

Week 3: `v=DMARC1; p=quarantine; pct=100; rua=...`

Monitor help desk tickets and delivery logs for any false positives.

Phase 4: Full Enforcement (`p=reject`)

Lock down your brand permanently:

`v=DMARC1; p=reject; aspf=r; adkim=r; rua=mailto:dmarc-rua@yourdomain.com`

Any unauthenticated message spoofing your domain is now blocked outright before reaching the recipient's inbox.

Build and customize your DMARC migration policy using the DomainAuditHQ DMARC Generator.