From p=none to p=reject: The Complete DMARC Enforcement Journey in 2026

You've set up DMARC. It's at p=none. You're getting reports. Now what?

This is where 65% of organizations get stuck. They implement DMARC for compliance but never reach enforcement, leaving their domains vulnerable to spoofing. In 2026, with major providers penalizing non-enforcement, getting to p=reject is no longer optional.

Why Most Organizations Stall at p=none

Common Fears

• "What if we block legitimate email?"
• "We don't understand the DMARC reports"
• "We don't know all our sending sources"
• "IT doesn't have time to manage this"

The Reality

These fears are valid but manageable. With a structured approach, any organization can reach p=reject in 30-60 days without disrupting email delivery.

The 4-Phase Journey

Phase 1: Discovery (Week 1-2)

Goal: Identify all legitimate email sources

Step 1: Start with p=none and aggregate reporting:

v=DMARC1; p=none; rua=mailto:[email protected]; pct=100

Step 2: Collect at least 2 weeks of DMARC reports

Step 3: Analyze reports to identify:

• All IP addresses sending as your domain
• Which sources pass SPF
• Which sources pass DKIM
• Which sources fail both (potential spoofing OR misconfigured legitimate senders)

Step 4: Create a complete sending source inventory:

Phase 2: Remediation (Week 2-3)

Goal: Fix authentication failures for all legitimate sources

For each source that fails SPF or DKIM:

Fix SPF failures:

• Add the service's SPF include to your record
• Verify IP addresses are listed
• Stay under 10 DNS lookups

Fix DKIM failures:

• Enable DKIM signing in the service's settings
• Add DKIM DNS records for each service
• Verify DKIM alignment matches your domain

Example updated SPF:

v=spf1 include:_spf.google.com include:servers.mcsv.net include:spf.salesforce.com -all

Phase 3: Gradual Enforcement (Week 3-4)

Goal: Move to quarantine with percentage rollout

Step 1: Move to p=quarantine at 10%:

v=DMARC1; p=quarantine; pct=10; rua=mailto:[email protected]

This means only 10% of failing emails get quarantined. Monitor closely.

Step 2: If no issues after 3-5 days, increase to 50%:

v=DMARC1; p=quarantine; pct=50; rua=mailto:[email protected]

Step 3: After another 3-5 days with no issues, go to 100%:

v=DMARC1; p=quarantine; pct=100; rua=mailto:[email protected]

Phase 4: Full Enforcement (Week 4+)

Goal: Achieve p=reject

After 1-2 weeks at p=quarantine with 100% and no issues:

v=DMARC1; p=reject; rua=mailto:[email protected]; pct=100; adkim=r; aspf=r

Congratulations! Your domain is now fully protected against exact-domain spoofing.

Troubleshooting Common Issues

"Legitimate emails are failing DMARC"

1. Check DMARC reports for the failing source
2. Verify SPF includes the sending service
3. Ensure DKIM is enabled and aligned
4. Check for email forwarding issues (use ARC where supported)

"I have too many SPF includes"

SPF is limited to 10 DNS lookups. Solutions:

• Use SPF flattening to convert includes to IP ranges
• Remove unused services from SPF
• Use our SPF wizard to optimize

"Third-party service won't support DKIM"

Some legacy services don't support custom DKIM. Options:

• Route email through a service that does (SendGrid, Postmark)
• Use a subdomain for that service
• Accept the risk and document it

Monitoring After Enforcement

Don't set and forget. After reaching p=reject:

• Weekly: Review DMARC aggregate reports
• Monthly: Audit sending sources for changes
• Quarterly: Review and update SPF/DKIM records
• Annually: Full email security assessment

Tools to Help

• Free Domain Scanner: Check your current DMARC status
• DIY Setup Guide: Step-by-step configuration help
• Professional Services: Expert-managed DMARC deployment

For businesses that need broader technology guidance, WiseTechySolutions offers IT consulting that includes email security as part of comprehensive technology strategy.

---

Every day at p=none is a day your domain can be spoofed. Start the enforcement journey today.

Scan your domain to see where you stand, or contact us for guided enforcement.