DMARC: From p=none to Enforcement, Safely

DMARC is what stops other people from sending email as you. But its power comes from its enforcement policy, and enforcing too fast can block your own legitimate mail. The safe path is a deliberate progression from watching to protecting.

The three policies#

A DMARC record tells receiving servers what to do with mail that claims to be from your domain but fails authentication:

• p=none — do nothing special, but send me reports. This is monitoring mode.
• p=quarantine — treat failing mail as suspicious; typically route it to spam.
• p=reject — refuse failing mail outright.

The goal is to reach p=reject, because that's the policy that actually prevents spoofing. But you don't start there.

Step 1: Publish p=none and read the reports#

Start in monitoring mode. Your mail flows normally, and receivers begin sending you aggregate reports showing every source sending mail as your domain — including sources you forgot about. Almost everyone discovers something here: a support tool, an invoicing system, a marketing platform, all sending "as you" without proper authentication.

Step 2: Fix alignment for every legitimate source#

Go through each legitimate sender the reports reveal and make sure it passes SPF and DKIM and aligns with your domain. This is the real work of DMARC, and it's why you don't skip the monitoring phase — the reports are your checklist. Anything you can't authenticate is something that will get blocked once you enforce, so you either fix it or move it.

Step 3: Move to quarantine, gradually#

Once the legitimate sources are clean, step up to p=quarantine. You can do this cautiously using the percentage tag to apply the policy to only a fraction of mail at first, watching your reports for any legitimate messages caught in the net. Ramp the percentage up as you gain confidence.

Step 4: Enforce with p=reject#

When quarantine is running clean at full coverage, move to p=reject. Now anyone spoofing your domain is refused at the door, and your recipients are protected from impersonation.

Don't set it and forget it#

New sending sources appear over time — a new tool, a new campaign platform. Keep an eye on your DMARC reports so a newly added, unaligned sender doesn't get silently rejected. In Buzzmark, the domain view shows your DMARC verification state alongside SPF, DKIM, and Return-Path, so you can confirm your Buzzmark mail is aligned before you tighten the policy that governs your whole domain.

Patience is the whole strategy. Monitor, fix, quarantine, reject — in that order — and you get full spoofing protection without ever blocking a message you meant to send.