Can I skip quarantine and go straight from none to reject?

You can, and for a simple single-provider domain with weeks of clean reports it is often fine. For anything with third-party senders, quarantine is worth the extra month because a mistake there is recoverable from a junk folder rather than bounced back to the sender.

What exactly does pct= do at p=reject?

Each receiver independently applies reject to that percentage of failing messages and drops the remainder down one severity level, which for reject means quarantine. So p=reject; pct=25 means roughly a quarter of failures are refused and three quarters are junked — not that three quarters are delivered.

Should I use adkim=s and aspf=s?

Rarely. Strict alignment requires the DKIM d= or the SPF domain to match the From: domain exactly, with no subdomain allowed. That breaks the very common pattern of signing or bouncing from a subdomain, and the security gain is small for most organizations. Relaxed is the default for good reason.

Do I have to keep the rua reports flowing after reaching reject?

Yes. Reports are how you find the sender that a department signed up for last week. Without them, the first symptom of a new unaligned sender is a user reporting that their mail bounced — after your policy already refused it.

What happens to forwarded mail under p=reject?

Plain forwarding breaks SPF because the forwarding server is not in your SPF record, so DKIM alignment is what keeps forwarded mail delivering. If DKIM survives the hop, DMARC still passes. This is the practical reason to get DKIM aligned before enforcing, not just SPF.

How do I roll back if something breaks?

Edit the TXT record back to the previous stage. It takes effect as fast as the record TTL lets caches expire, so keep a short TTL such as 300 to 3600 seconds during the rollout. Verify the rollback with dig +short TXT _dmarc.example.com rather than assuming the panel saved it.

DMARC p=none vs quarantine vs reject

The three policy values are a request to receiving mail servers about what to do with messages that fail DMARC — meaning neither SPF nor DKIM produced a result *aligned* with the From: header domain. They are a request, not a command; large receivers generally honour them, but they also apply their own reputation logic on top.

What does each policy actually do?

Policy	Receiver behaviour on failure	Spoofing stopped?	Risk to legitimate mail	Use when
`p=none`	Deliver normally, send aggregate reports	No	None	You are still discovering senders
`p=quarantine`	Deliver to spam/junk, or apply heavier filtering	Mostly — the mail arrives but is not seen	Recoverable — users can retrieve from junk	Your reports are clean and you want a safety margin
`p=reject`	Refuse at SMTP with a 5xx; sender gets a bounce	Yes	Unrecoverable — the message is gone and the sender is told	Every legitimate sender is aligned and verified

The important asymmetry: a wrongly quarantined message can be fished out of a junk folder. A wrongly rejected message produces a bounce to the sender and nothing in the recipient’s mailbox. That is why quarantine exists as a middle step rather than being skipped.

DMARC Checker

Policy, alignment, and why Gmail may reject you

Stage 1 — Monitor with p=none and rua

Publish the monitoring record and change nothing else. If the record does not exist yet, DMARC record not found has the publication steps and the common host-field mistakes.

Type:  TXT
Name:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:[email protected]; fo=1

Stage 1 record

Verify publication before you start counting weeks — a record in the wrong host field generates no reports at all:

dig @1.1.1.1 +short TXT _dmarc.example.com
"v=DMARC1; p=none; rua=mailto:[email protected]; fo=1"

Confirm from a public resolver

Aggregate reports start arriving within about 24 to 72 hours, one per receiver per day, as gzipped XML attachments. Add sp=reject at this stage if you never send from subdomains — it blocks a whole class of spoofing at zero risk while the root domain is still in monitoring.

Stage 2 — Read the reports and build a sender inventory

This is the stage that determines whether the rollout succeeds. Each aggregate report contains, per source IP: the message count, the SPF result and the domain it was evaluated against, the DKIM result and the signing domain, and the resulting DMARC disposition. Your job is to turn that into a list where every row is either "ours and aligned" or "not ours".

The raw XML is readable, but at any real volume use a report-processing service or a parser. What you are building is this table:

Source	SPF aligned?	DKIM aligned?	Action
Microsoft 365 tenant	Yes	No — signing not enabled	Enable DKIM, publish both selector CNAMEs
Transactional ESP	No — vendor bounce domain	Yes — `d=example.com`	Aligned via DKIM; optionally add a custom return-path
Marketing platform	No	No — signing as vendor	Configure a custom sending domain at the vendor
On-prem scan-to-email MFP	No	No	Route through the relay, or add its IP to SPF
Unknown offshore IPs, low volume	No	No	Spoofing — nothing to fix, this is what you are blocking

Two structural problems surface constantly here. First, SPF that has hit the 10-lookup limit and returns PermError — SPF then cannot contribute an aligned pass for anyone. Check it with the SPF checker and see SPF PermError: too many DNS lookups. Second, DKIM signing that is configured but not enabled, which is the Microsoft 365 default until both CNAMEs are published — see Microsoft 365 DKIM setup.

Email Deliverability Test

SPF + DKIM + DMARC + MX + PTR on one screen

Stage 3 — Fix alignment for every legitimate sender

Aim for both mechanisms aligned where you can. SPF breaks on forwarding; DKIM survives it. Two aligned mechanisms means one can break without failing DMARC.
For each ESP, set a custom signing domain (so d=example.com) and a custom bounce/return-path domain (so smtp.mailfrom is a subdomain of yours). Both are standard features and both are usually off by default.
Verify each fix with a real send, not the vendor’s status page — read Authentication-Results in the delivered message, or paste the headers into the email header analyzer.
Resolve the DKIM key you just published: the DKIM checker will find the selector, or see how to find your DKIM selector.
Leave adkim/aspf at the default relaxed setting. Strict alignment requires an exact domain match and breaks subdomain-based sending for no security benefit in most setups.

Do not move to Stage 4 while any legitimate source in your reports still shows dmarc=fail. The report is the evidence; a successful test message is not.

Stage 4 — Ramp with pct=, then quarantine

The pct= tag applies the policy to a percentage of failing messages, chosen at random by each receiver. Messages not selected fall back one level of severity: under p=quarantine they are delivered normally, and under p=reject they are quarantined instead. That makes it a genuine dial, not just a sampling toggle.

v=DMARC1; p=quarantine; pct=10; rua=mailto:[email protected]
v=DMARC1; p=quarantine; pct=50; rua=mailto:[email protected]
v=DMARC1; p=quarantine; pct=100; rua=mailto:[email protected]

The quarantine ramp, one record at a time

Hold at each step for at least one full reporting cycle plus a business week — you want a Monday morning and a month-end billing run inside the window. Watch two signals: aggregate reports for new failing sources, and your helpdesk for "did you get my email" tickets. If either moves, drop back a step.

Stage 5 — Reject

v=DMARC1; p=reject; sp=reject; pct=100; rua=mailto:[email protected]; fo=1

Full enforcement

Ramp pct= on reject the same way if you want to be careful, though a domain that has sat clean at p=quarantine; pct=100 for a month can usually go straight to p=reject. Keep rua= forever — enforcement is not the end of monitoring. New SaaS tools get bought, and the first sign is a fresh unaligned source in next week’s report.

A realistic timeline

Week	Record	What you are doing
0	`p=none; rua=...; sp=reject`	Publish, verify with dig, start collecting
1–3	`p=none`	Build the sender inventory from reports
3–6	`p=none`	Fix alignment sender by sender; re-verify each in reports
6–7	`p=quarantine; pct=10`	First enforcement. Watch reports and the helpdesk
8–9	`p=quarantine; pct=50`	Hold through a full business cycle
10–12	`p=quarantine; pct=100`	All failing mail to junk
13+	`p=reject; sp=reject`	Full enforcement; keep reading reports indefinitely

Three months is a normal pace for an organization with a handful of third-party senders. A single-provider domain with no marketing tooling can compress this to three or four weeks. A large enterprise with acquisitions and shadow IT should expect two quarters, and the time goes into Stage 2 and 3, not into waiting.

BIMI — displaying your logo in supporting mailbox providers — requires an enforcing DMARC policy on the organizational domain, typically p=quarantine with pct=100 or p=reject. Check what is published with the BIMI checker.

What enforcement does not fix

Lookalike domains. exarnple.com has its own DMARC record and your policy is irrelevant to it.
Display-name spoofing. From: "CEO Name" <[email protected]> passes DMARC for gmail.com and always will.
Compromised accounts sending through your own authenticated infrastructure — that mail is aligned by definition.
Poor IP reputation. Check with the blacklist check and confirm PTR with reverse DNS.
Mailing lists that rewrite bodies and break DKIM — see body hash did not verify.

DMARC Record Generator

Create a DMARC record with a safe rollout policy