How to move DMARC to reject without breaking your email

Enforcement is where DMARC actually stops impersonation, and where teams are most afraid of black-holing real mail. Done in the right order, you reach p=reject without losing a single legitimate message. Here's the playbook.

Why you can't just flip the switch

Moving straight to p=reject before your real senders are authenticated will reject your own invoices, newsletters and notifications. Avoiding enforcement isn't the answer. You reach it in a controlled sequence, so only forgeries get blocked.

Step 1 — Turn on reporting and watch

Publish a DMARC record at p=none with an aggregate report address (rua=mailto:...) and leave it for about two weeks. The reports reveal every service sending as your domain — including ones nobody remembers.

Step 2 — Inventory every legitimate sender

From the reports, list each real sender: your mail platform (Microsoft 365, Google Workspace, Fastmail), CRM, invoicing, help desk, marketing tool, and any servers. This inventory is the single most important artifact in the whole process.

Step 3 — Authenticate each one (SPF and DKIM)

For every sender, make sure it's covered by SPF and signing with DKIM, and that the signing domain aligns with your From domain. Watch your SPF lookup count — adding senders is exactly how domains blow past the 10-lookup limit.

Step 4 — Ramp through quarantine

Move to p=quarantine and watch the reports for any legitimate mail being caught. When it's clean, you're ready for the last step.

Step 5 — Reject (and cover subdomains)

Set p=reject at pct=100.
Set sp=reject so subdomains can't be spoofed.
Keep watching reports — every new tool your team adds can quietly break alignment.

What breaks enforcement (and how to avoid it)

A forgotten sender — the classic cause of blocked real mail. The inventory prevents it.
Forwarding and mailing lists — they break SPF; DKIM alignment keeps them passing.
Unprotected subdomains — without sp=reject, attackers just move next door.
Drift — enforcement isn't "set and forget." New vendors silently re-open the gap.

Frequently asked questions

How long does it take to get to DMARC reject?

For most organizations, a few weeks. You typically spend about two weeks at p=none gathering reporting data to find every sender, then a week or two ramping through quarantine before moving to reject. Complex, multi-domain environments take longer.

Will p=reject block forwarded mail?

It can, because forwarding often breaks SPF. That's why DKIM matters: a valid DKIM signature survives most forwarding, so a message that is DKIM-signed and aligned still passes DMARC even when SPF breaks. Authenticating with both is what keeps forwarded mail flowing.

What's a safe pct ramp for DMARC?

A common path is quarantine at pct=100, watch for a week, then reject. Some teams ramp pct (e.g. 25 to 50 to 100) for extra caution, but pct is a blunt instrument — the real safety comes from authenticating every sender first, not from a slow percentage.

Get a sender inventory in the first scan

StopForge's free exposure scan reads your live records and shows exactly where your email authentication stands — what passes, what silently fails, and whether anyone can still send as your domain. No changes to your mail, no obligation.

See if your domain can be spoofed

← All guides