DMARC from none to reject

DMARC from none to reject means you publish a policy that starts by watching failures, then quarantines them, and only later refuses them at delivery. You begin with p=none and a real rua mailbox you read, tighten to quarantine once sources look clean, and finish at reject when you trust the list. Jumping straight to reject often blocks a billing or CRM sender you forgot, so invoices never arrive.

Publish the DMARC record in DNS

The record is a single TXT at _dmarc on your domain, for example _dmarc.example.com. You can confirm what is live with a simple lookup:

dig +short _dmarc.example.com TXT

A sensible first value looks like v=DMARC1; p=none; rua=mailto:[email protected]. That address must exist, and someone on your side must open the reports. Without that, you change policy without knowing which mail still fails. The optional pct= tag is rarely needed if you actually review reports for a few weeks before each step.

Keep SPF and DKIM aligned underneath

DMARC does not replace SPF or DKIM. It checks whether at least one of them passed and aligned with the domain in the From header. Alignment is easy to miss. SPF needs to match the From domain or its parent under relaxed mode, and DKIM needs a matching d= domain. A list that rewrites From, or a vendor that signs only with its own domain, can show a pass that DMARC still treats as a fail. A reject policy with weak SPF such as ~all and no working DKIM will fail your own mail. Fix the mechanisms first, then raise p=.

Find every sender before you tighten

CRMs, billing systems, form plugins, printers that email PDFs, Google Groups, and an accountant’s Office 365 often sit outside the main server. Aggregate reports name those sources while you stay at none. Walk the list, add legitimate senders to SPF or DKIM, or stop using the ones you no longer need. After a stretch of clean reports, move to p=quarantine, watch again, then set p=reject.

What receivers do with each policy

With none, receivers mostly report and still deliver. With quarantine, many place failing mail in junk or spam. With reject, they refuse the message at SMTP. BIMI expects an enforcing policy before it will show a logo, so do not publish BIMI while you remain at none.

After each DNS change, dig the record again, send a test from every real path, and keep reading rua. Policy is a ladder; skipping rungs is how you page yourself over lost mail. The XML is ugly, but a simple parser or a mailbox search for your domain is enough. If a source fails for two weeks and you do not recognize it, leave it failing as likely spoofing. If you do recognize it, include it properly or stop using it. BIMI still waits at the top of that ladder.