webzod
account

Move DMARC from monitoring to quarantine, then reject

email.dmarc.policy_none · effort: a project

Why it matters

p=none only monitors, so receivers still deliver spoofed mail that claims to come from your domain. Enforcing the policy is what actually blocks it, but it has to be done in steps so legitimate mail is not caught.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

  1. Before changing anything, read the aggregate reports collected under p=none (a few weeks is typical). Every legitimate sender (mail provider, newsletter tool, contact forms, helpdesk) must pass SPF or DKIM in alignment with your domain. Fix those that do not by completing their SPF and DKIM setup.
  2. Stage 2: change p=none to p=quarantine and watch the reports and any complaints for one to two weeks. Failing mail now goes to spam. To roll back, set p=none again. Do not ease in with pct: RFC 9989 replaced it with the t=y test flag, and percentage values are applied unreliably.
  3. Stage 3: when reports stay clean at p=quarantine, change to p=reject. Keep rua in place afterwards to spot new senders. Receivers that implement RFC 9989 treat p=reject with t=y as quarantine; receivers that do not know t ignore it and reject in full, so t=y is no safe way to ease in.
  4. Edit the existing _dmarc record at each stage and keep your other tags (rua, adkim, aspf, sp) as they are. DNS changes can take as long as the TTL to reach receivers.
  5. If the domain sends no mail, go straight to p=reject; there is no legitimate mail to protect.
dns 
; Stage 2: replace the current record with this (keep your own rua and any other tags)
_dmarc.example.com.  IN TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com"

; Stage 3, after clean reports. It REPLACES the record above; never publish two.
;   "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com"

The examples use example.com. Replace it with your own domain.

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.