Moving to p=reject safely

p=reject is the most valuable change most domains can make: receivers refuse mail that pretends to be you. The risk is refusing your own mail from a service you forgot, so go in steps and read the reports at each one.

The steps

1. Publish p=none with a report address. Nothing changes for delivery, but receivers start sending you reports.
2. Wait and read. Look for services in the reports that fail. Fix each one, usually by adding its SPF include or its DKIM key, or confirm it isn't yours.
3. Move to p=quarantine. Failing mail goes to spam rather than being refused, so mistakes are recoverable.
4. Wait and read again.
5. Move to p=reject.

Two to six weeks between steps is typical. Busier domains, with more services, should go slower.

Things to watch

• Forgotten senders: the help desk, the billing system, the event platform. The Mail flows tab lists every sender we can see. Mark each as yours or not.
• Subdomains: sp= sets their policy. A subdomain that sends mail through a service needs that service set up there too.
• pct= and t=y hold enforcement back. Newer DMARC drops pct=, so remove it when you're ready to enforce.

In healthcheck.email

The DMARC rollout card on the domain's Overview proposes these steps with dates, from where your domain is today. Pick a pace, change any date, and accept. Each step shows the exact record to publish, ticks off when a check sees it, and appears in Coming up and your calendar.