dmarcula
Log in Sign up

The DMARC enforcement journey.

DMARC only stops spoofing once you enforce it at p=reject. But you don't leap there from p=none. You climb through p=quarantine one safe step at a time, so you never block a legitimate email on the way up. Here's the ladder, what each policy means, and how dmarcula tells you when it's safe to take the next rung.

A three-step staircase climbing from p=none (monitor) up through p=quarantine (filter) to p=reject (block): the safe progression to full DMARC enforcement.
Climb safely: none → quarantine → reject.

The three rungs

  • p=none: Monitor. Reports flow in; nothing is blocked. Every domain starts here. You're building a complete picture of who sends email as you.
  • p=quarantine: Filter. Mail that fails DMARC is sent to spam/junk instead of the inbox. The cautious middle rung, a safety net that catches spoofing without hard-bouncing anything.
  • p=reject: Block. Failing mail is refused outright. This is the destination: real protection. Spoofed mail in your name simply doesn't get delivered.

How to climb safely

The whole game: never advance until your legitimate mail is fully authenticated and aligned. The order that works:

  1. Stay at none until the picture is clean. Watch until your authentication rate is high and steady, and every legitimate sender (your mail platform, marketing tools, ticketing system) is identified and passing SPF or DKIM with alignment.
  2. Fix the gaps first. Hunt down sources that should pass but don't: a new ESP you forgot to set up, a tool sending without DKIM.
  3. Soft-test a rung with t=y. DMARCbis (2026) removed the old pct tag - receivers now treat any value under 100 as 100, so pct=25 no longer eases you in, and p=reject; pct=25 would reject everything. Instead add the t=y testing flag: it tells receivers to apply the next-lower policy, so p=quarantine; t=y reports failures while still delivering, and p=reject; t=y behaves like quarantine. Drop t=y once the rung runs clean. One catch during the transition: t=y is a new DMARCbis tag, so receivers that haven't adopted DMARCbis yet ignore it and act on the full policy - p=reject; t=y still rejects at those inboxes. Treat t=y as a partial safety net, not a full brake: the real monitoring happens at p=none, where every receiver only reports, before you ever climb.
  4. Give each rung a week or two. Mail patterns vary by day and week. Let a rung settle and watch for surprises before climbing.
  5. Then reject. Once quarantine has run clean, p=reject is a small, confident step.

dmarcula does the watching. You don't have to track all this in your head. The journey card on your dashboard watches your authentication rate and your senders, tells you which rung you're on, and nudges you forward the moment the data says the next step is safe, and holds you back when it isn't.

Watch out for

  • Don't skip to reject. The most common mistake, and it bounces real mail. Earn each rung.
  • Don't forget subdomains. A separate sp= policy governs subdomains, so lock those down too, or they become the spoofer's open door. See Subdomains and DMARC for sp, np, and running several.
  • Forwarding breaks SPF. DKIM saves you. Forwarded mail and mailing lists often fail SPF because the path changed. A valid, aligned DKIM signature survives forwarding, which is why getting DKIM right on every sender matters before you enforce.
  • Mind your third parties. Marketing platforms, invoicing tools, help desks. Each needs SPF/DKIM set up and aligned, or they'll fail the moment you enforce.

What's next