The DMARC checklist 2026: from zero to p=reject

Step 3 — Setting up DKIM

Where SPF authorises servers, DKIM cryptographically signs the messages: every email carries a signature the recipient verifies against a public key published in DNS. A valid signature survives forwarding, where SPF breaks — which is why DKIM is the more robust alignment pillar. The part that trips people up at first is the selector: that label (s1._domainkey, google._domainkey…) which lets a domain carry several keys in parallel. The selector, explained clears it up; the DKIM pillar covers key generation and the rest. A 2048-bit key is the right target.

Step 4 — Publishing DMARC at p=none with rua

Only now does DMARC get published — and it gets published at p=none. That is not protection, it is a microscope: p=none blocks nothing, it simply asks to receive reports. The decisive tag at this stage is rua, the address that collects the daily aggregate reports. Without rua the domain is blind; with it, who sends in its name finally becomes visible. A minimal record looks like v=DMARC1; p=none; rua=mailto:reports@example.com. The urge to move faster is worth resisting: p=none is the observation step, and skipping it means enforcing blind.

Step 5 — Reading the aggregate reports

Once the reports start arriving, they have to be read — and this is where many give up, because the raw format is XML unreadable to the naked eye. These aggregate reports say, source by source, how many messages passed or failed SPF and DKIM, and above all alignment. Learning to decode them is the real turning point of the project: it is what turns "I publish DMARC" into "I know what my domain does." Making sense of what the receivers return explains what to look at and in what order. Two or three weeks of data should accumulate before any conclusion.

Step 6 — Fixing alignment, source by source

This is the heart of the work, and the longest step. The reports reveal legitimate sources that fail alignment: a provider signing under its own domain (d=), a forgotten server, a missing SPF include. Each one gets fixed — the provider's DKIM key published, the include added, signing turned on. The goal: 100% of the legitimate mail passing SPF or aligned DKIM. Enforcing while a single legitimate source is still failing is the mistake to avoid; that is the one that will drop. This methodical remediation phase is exactly what the none-to-reject checklist describes — each source ticked off before moving on.

Step 7 — Moving to quarantine

When the reports are clean — no legitimate source failing anymore — comes the first enforcement step: p=quarantine. Mail that fails DMARC then goes to spam rather than being delivered. And this is where DMARCbis changes the method: the old pct=25 is out, unpredictable and removed from the standard. In its place comes the t=y test mode, which tells recipients "I'm experimenting, report failures to me without hardening strictly yet." The ramp-up is steered by watching the reports, not by a hazardous percentage. The DMARCbis t tag details that mechanism; on the deeper difference between the two levels, quarantine or reject, which to choose settles the question.

Step 8 — Moving to p=reject

This is the step everything else was preparing for. At p=reject, fraudulent mail is refused before it reaches the recipient's inbox — spoofing the domain becomes impossible, not merely reported. Where steps 1 through 7 were done properly, this transition is a non-event: the sources are aligned, the reports are clean, only the fraudsters are left to block. The full method, with the precautions to break no flow, is described in getting to p=reject without breaking email. The switch gets flipped only when several weeks of quarantine reports confirm that only the illegitimate fails.

Step 9 — Locking down the subdomains

p=reject protects the root domain, but an attacker is clever: the aim shifts to invoices.example.com or a subdomain that never existed. Two tags close that door. sp sets the policy for existing subdomains; np, a DMARCbis addition, covers non-existent subdomains — the favourite target, because forging a name that does not exist raises no DNS-side alarm. Setting np=reject is free and carries not the slightest risk to legitimate mail. The subdomain policy (sp) and the np tag for non-existent subdomains detail each one's role. This is where the DMARCbis DNS Tree Walk does its work behind the scenes, cleanly tying each subdomain to its policy.

Step 10 — The reward: BIMI

Once at p=reject, a visible benefit unlocks: BIMI displays the brand's official logo next to its messages in supporting inboxes (Gmail, Apple Mail…). It is not just decoration — it is a trust signal that lifts open rates and makes impersonation harder. BIMI requires p=reject or p=quarantine: it is literally the carrot at the end of the path. Setting up BIMI and showing a logo in Gmail covers how to publish the record and, where needed, obtain the certificate that goes with it. It is the medal earned after the climb.

What the checklist does not say loudly enough

A reread of the ten steps makes one thing jump out: eight of ten are not configuration, but observation and correction. Publishing three tags takes five minutes; knowing when to harden them takes weeks of reading reports. That is the exact opposite of intuition, and it is precisely where most domains stall — not for want of knowing how to write a record, but for want of holding the alignment discipline long enough. The 2026 landscape does not change that truth: DMARCbis modernises the tooling (Tree Walk, np, t=), it does not shorten the climb. The full switch to the new standard, once p=reject is reached, is mapped separately, but it is never the first priority — enforcement is.

A nuance that saves projects: a checklist is not a race. Nobody hands out a prize for reaching p=reject in a week, and nobody penalises a climb that takes three months. What counts is not the speed of the climb — it is its safety. A domain rushed to p=reject that blocks its own invoices on a Monday morning has failed more completely than a domain that patiently stayed at quarantine long enough to align its last source. Each step gets climbed when the previous one is solid, not before. It is as boring as that, and it is as effective as that.

Checking where a domain stands, right now

The first step is free and takes ten seconds. A domain run through our free DMARC analyzer gets an instant verdict on its current policy, its SPF and DKIM records, and the exact step of the checklist where it sits. To place a posture against its sector — and see how many domains are still stuck at p=none — the DMARC Observatory gives the panorama.

Holding this checklist by hand, source by source and week after week, is doable but tedious. That is exactly what Thomas, the virtual CISO, automates: he inventories the sources from the reports, names each one, generates the exact DNS to publish (DMARCbis tags included: np, t), measures readiness per domain and names the precise step at which to harden without risk. Analyze a domain for free · explore the Observatory · get started with Thomas.