DMARC p=none: how to move to quarantine and reject safely

What's wrong

p=none is monitoring mode: receivers send reports, but mail with a spoofed From is delivered as usual. Gmail and Yahoo require DMARC from bulk senders, but only quarantine or reject actually protects you.

Rollout plan

1. Turn on reports if missing: rua=mailto:dmarc@example.com. Without them you won't know who sends as you.
2. Read reports for 2–4 weeks. Find every legitimate source (mailbox provider, CRM, newsletters, help desk) and make sure each passes SPF or DKIM aligned with the From domain.
3. Tighten step by step:

_dmarc.example.com. TXT "v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@example.com"
; a quiet week later — pct=100, then:
_dmarc.example.com. TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"

4. Subdomains inherit the policy; if they send no mail, add sp=reject.

Common mistakes

• Switching to reject before checking third-party senders — mail from your CRM, for example, stops arriving.
• Forwarding breaks SPF, which is why every source needs DKIM.

Check it in Email DNS Checker, DMARC section.