Move DMARC from quarantine to reject

Why it matters

p=quarantine sends spoofed mail to spam, which is good, but p=reject stops it from being delivered at all. It is the final stage once your reports show no legitimate mail failing.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Read the recent aggregate reports. Move on only if all legitimate senders pass DMARC and nothing you recognise is being quarantined.
2. Change p=quarantine to p=reject and leave your other tags (rua, adkim, aspf, sp) as they are. Do not ease in with pct: RFC 9989 removed it and receivers apply partial values unreliably. Reject is a one-step change, so rely on the clean reports instead.
3. Keep rua so you notice new senders that start failing, and roll back to p=quarantine if legitimate mail is rejected.

; Replaces the current record (keep your own rua and any other tags)
_dmarc.example.com.  IN TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com"

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the DMARC policy check
• Publish a DMARC record, starting in monitoring mode
• Keep only one DMARC record
• Fix the invalid DMARC record
• Move DMARC from monitoring to quarantine, then reject
• Remove the pct tag from the DMARC record
• Remove the t=y test flag from the DMARC record
• Make the DMARC subdomain policy match the main policy
• Add a report address to the DMARC record
• Remove or fix the invalid tags in the DMARC record