Getting to DMARC p=reject without breaking your mail
19 July 2026 · 6 min read
Start at none and read the reports
p=none changes nothing about delivery and starts the reports flowing. Give it a few weeks. Every marketing tool, invoicing system, helpdesk and CI job that mails as you will show up, and there are always more than anyone expects.
Fix alignment, not just authentication
A vendor passing their own SPF does not help you. You need SPF or DKIM to pass for **your** From: domain. Usually that means letting them DKIM-sign with a key published on a subdomain of yours.
Then quarantine, then reject
- p=none until the reports are quiet.
- p=quarantine with pct=, raising it gradually.
- p=reject once a full cycle is clean, including annual senders.
More on guides
How to read email headers without guessing
Received lines read bottom to top, Authentication-Results is the verdict, and the timestamps tell you who was slow.
Use a subdomain, unless you really mean it
Pointing your main domain’s MX at a new service takes over all of its mail. A subdomain gets you the same feature with none of the risk.
How long should a temporary inbox live?
Long enough for a slow verification email, short enough that it is genuinely gone.