DMARC Policy: From None to Reject Safely

DMARC tells a receiver what to do when SPF and DKIM both fail to align with the visible From domain. The policy lives at _dmarc.example.com. Starting at p=reject on day one is how you break invoices, calendar invites, and the forgotten helpdesk tool. Starting at p=none and never raising it is how spoofed mail keeps landing. The work is the path between those two states.

Alignment is the actual rule

SPF can pass for a bounce domain that is not the From domain. DKIM can pass for a vendor domain while From says example.com. DMARC requires at least one of those passes to align:

• SPF alignment: the MAIL FROM (or HELO, in some edge cases) domain matches From. Relaxed alignment allows a subdomain. Strict alignment (aspf=s) requires an exact match.
• DKIM alignment: the d= domain on the signature matches From. Same relaxed versus strict choice (adkim=s).

If either aligned pass exists, DMARC passes. If neither does, the published p= applies: none (monitor), quarantine (junk), or reject (5xx). pct= can roll out reject to a percentage of mail; treat it as optional. rua= is not optional if you want to move policy with evidence.

Publish none, with a mailbox that you read

A first record should look like this:

; _dmarc.example.com
_dmarc.example.com.  IN TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com; ruf=mailto:dmarc@example.com; fo=1; adkim=r; aspf=r; pct=100;"

rua= receives aggregate XML (usually daily). ruf= receives forensic samples; many providers no longer send ruf, so do not depend on it. The rua mailbox must accept mail from outside your domain, because reporters will fail SPF on purpose. Either use a dedicated inbox with a wide SPF exception for the report stream, or use a third-party rua processor.

fo=1 asks for a forensic report if DKIM or SPF fails, not only if both fail. Keep adkim and aspf relaxed until you know every vendor signs the parent domain.

Read reports before you tighten

Aggregate reports list source IP, SPF/DKIM results, alignment, and volume. Group them by IP and by header From. You will find:

• Your VPS and your ESP, which must show aligned pass.
• Forwarders and mailing lists, which often fail SPF and pass (or fail) DKIM.
• Random hosts spoofing From, which is the traffic reject will drop.

If a legitimate tool shows up as fail, fix that tool: add its include to SPF, or have it DKIM-sign as example.com, or move its From to a subdomain with its own DMARC. Do not raise p= while a weekly invoice vendor still fails alignment.

dig +short TXT _dmarc.example.com
# After a week of rua XML, raise policy
# v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; pct=100;
# Then, after another quiet week:
# v=DMARC1; p=reject; rua=mailto:dmarc@example.com; sp=reject; pct=100;

sp= sets policy for subdomains. If you never send from hosts under example.com, sp=reject stops spoofed billing.example.com while you still ramp the parent. If you do send from mail.example.com, give that name its own _dmarc record rather than inheriting a surprise.

Subdomains, pct, and the point of no return

p=quarantine is the rehearsal for reject. Users at strict providers will start seeing junk. Watch support tickets for a week. pct=25 on reject is a way to canary; some large receivers ignore pct, so do not treat it as a safety net.

Once p=reject is live, a new SaaS that sends as you without signing will bounce. Make From domain plus DKIM selector part of vendor onboarding. DMARC does not replace SPF or DKIM; it fails closed only when both are present and aligned for every real sender.

rua XML is unsigned in practice. Treat the reports as a census, not as proof of a specific incident. If a source IP in the report is yours, fix alignment. If it is not yours, that volume is exactly what p=reject will refuse. Do not chase every forwarding path; if a member of staff forwards to Gmail and those copies fail SPF, that is expected and not a reason to stay on p=none forever.

Takeaway

p=none is a sensor, not a policy. Read rua, fix every legitimate source, then quarantine, then reject. You can spin up an Ubuntu 24.04 instance on Netbay in under 60 seconds to host a rua mailbox and an OpenDKIM signer on a static Lucknow IP — netbayhosts.in.