How to get to p=reject without breaking email

Step 2: Inventorying every legitimate sender

The aggregate reports reveal every IP sending as the domain. The work is to turn that list of addresses into a list of services: "that high-volume IP passing DKIM is the email platform; the one failing both is the CRM; this other one is a survey tool marketing forgot about." This inventory is the whole game — no policy can be safely enforced until its owner knows, with confidence, who legitimately sends for the domain. Surprises are the rule; there are always a few sources nobody remembered.

Step 3: Aligning each legitimate source

Every legitimate sender must not only pass SPF or DKIM but align with the From: domain. In practice that usually means setting up DKIM signing with a branded domain (d=example.com) on each platform, because third-party senders rarely align SPF. The work continues down the list until every real source shows an aligned pass in the reports. This is the bulk of the effort, and it's where most of the calendar time goes.

Step 4: Moving to quarantine

When the reports show the legitimate sources all aligned, the policy rises to p=quarantine. Unauthenticated mail now goes to spam rather than the inbox — a real defense, but a reversible one if something slipped through. Historically, this was staged with the pct tag (pct=25, then 50, then 100) to apply the policy to a growing fraction of failing mail. DMARCbis (2026) removes pct in favor of a binary testing mode (the t=y tag) and a ramp driven by report observation rather than a percentage. In practice today: where tooling and receivers still honor pct, it remains usable through the transition; otherwise, the move goes in short steps — a few days at quarantine, watching the reports — before reject.

Step 5: Moving to reject

When quarantine runs clean — the only failing sources left are unrecognized ones, i.e. spoofers — the policy rises to p=reject. Receivers now refuse forged mail in the domain's name at the door. The subdomain policy (sp) moves to match, so attackers can't simply pivot to a subdomain. Enforcement is reached.

DMARCbis: what changes for the policy ramp

Published in May 2026 (RFC 9989/9990/9991), DMARCbis modernizes the standard without making this path obsolete — the none → quarantine → reject sequence is still exactly right. Two new things deserve attention during the ramp:

• The np tag. It sets the policy for non-existent subdomains — a classic spoofing target, because an attacker can forge invoice.example.com even if that subdomain doesn't exist. It's a fast, zero-risk win: np=reject goes in early, as soon as the root is healthy, since no legitimate mail comes from subdomains that don't exist.
• pct → t and the DNS Tree Walk. pct is gone (see Step 4) and organizational-domain discovery no longer depends on the Public Suffix List but on a sequence of DNS queries (up to eight). Nothing to redo in the progression: the record stays valid — it's just a good moment to drop a now-useless pct.

How long does it take?

For a small domain with one or two senders, days. For a large organization with dozens of platforms across business units and regions, a few months is normal — most of it spent on Step 3, aligning sources, not on flipping the policy. The pace is set by how quickly each platform can be configured, not by DMARC itself. For more detailed benchmarks by organization size and stage, see how long it takes to reach p=reject.

How to know the moment to tighten

The right moment doesn't have to be guessed: the reports settle it. Three concrete signals before moving up a rung:

• Every known legitimate source shows an aligned pass across several days of reports — not once by chance, but steadily.
• The only failing rows left are unrecognized IPs, at low volume or in isolated spikes: the profile of a spoofer or a forwarder, not a business service.
• No monthly sender is missing. Billing, statements, quarterly campaigns: at least one full cycle must have gone by before the inventory can be called complete.

If all three boxes are ticked, the next step is safe. If not, the policy stays where it is until the missing source is fixed — tightening on an incomplete inventory is exactly what breaks legitimate mail. With DMARCbis, np=reject can also be set for non-existent subdomains right away, since no real mail comes from them — one less thing to wait on.

Common pitfalls on the way

• Tightening too early. The single most common way to break mail. The reports must prove a source is aligned before enforcement hits it.
• Forgetting the envelope vs header distinction. A source can pass raw SPF yet fail DMARC because it isn't aligned. Alignment is what counts, not just pass/fail.
• Leaving subdomains open. Enforcement on the root means little if sp is forgotten: spoofers simply move to mail.example.com.
• Stopping at quarantine. It's progress, but spoofed mail still reaches the spam folder where some users dig it out. reject is the goal. The two rungs are not equivalent — this side-by-side comparison shows what each one actually blocks.

Anchoring the practice in the organization

One last lever isn't about DNS but about governance. The sending teams — marketing, HR, sales, product — need warning before each policy step: they're the first to notice a campaign landing in spam, and a fast report beats a late discovery. Above all, one simple rule has to be installed for what comes next: no new sending tool goes live without a DKIM signature aligned on the domain. Without that reflex, the first platform someone signs up for after the move to reject will see its messages vanish silently, and the organization relives the very incident the methodical climb spared it. Enforcement isn't a state that gets reached; it's a state that gets maintained — and maintenance costs far less when it's built into procurement than when it's improvised after the fact.

Why p=reject is worth the effort

Reaching enforcement is a real project, so it's fair to ask what it buys beyond ticking a compliance box. Quite a lot, as it turns out:

• Spoofing actually stops. This is the headline. At p=reject, a forged email using the exact domain in the From: is refused by receivers before it ever reaches a customer. Phishing that impersonates the brand simply stops being deliverable — not filtered, not flagged, but rejected outright.
• Better deliverability for real mail. Mailbox providers trust enforcing domains more. A domain at p=reject with clean alignment is a strong positive reputation signal, and its legitimate campaigns and transactional messages benefit from it every day.
• Compliance, handled. Enforced DMARC satisfies the Gmail and Yahoo sender requirements with room to spare, and stands as a clear, auditable control to point to for frameworks like NIS2 and DORA.
• The logo opportunity. Only enforcing domains can publish BIMI and display a verified logo in the inbox — a visible trust mark and a brand asset no other route unlocks.
• Peace of mind that lasts. Once a domain sits at reject with monitoring still in place, any new unauthorized sender shows up in the reports instead of in customers' inboxes. The hard part is the climb; staying there is mostly watching the reports stay clean.

Set against the cost of a single successful impersonation — fraud losses, support overload, lasting brand damage — the few weeks of alignment work pay for themselves quickly. The real mistake was never the effort of the climb; it's stopping at p=none and mistaking monitoring for protection.

Thomas does the heavy lifting

That sequence is exactly what Thomas, the virtual CISO, automates. He ingests the reports, names every sending source, generates the precise DNS to paste (DMARCbis tags included), scores the domain's readiness on rolling data, and indicates the exact moment each step is safe — from p=none all the way to p=reject, without breaking a single legitimate email.

Free DMARC analysis or account signup to get started. For a view of how whole sectors are doing, the DMARC Observatory shows in black and white how many domains stall halfway, at p=none.