Guide · For MSPs and IT teams

How to move a domain from p=none to p=reject without breaking anyone's email

p=none tells receivers to do nothing with mail that fails DMARC. It protects nobody. The good news: getting to p=reject is mostly careful bookkeeping. Here's the order we use for every client domain.

1. Turn on reporting first

You can't enforce safely until you know who sends as the domain. If the record has no rua tag, add one and leave the policy at none:

_dmarc.example.com  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@yourmsp.com"

If the reports go to a mailbox on a different domain, that domain has to publish an authorisation record (example.com._report._dmarc.yourmsp.com) or receivers won't send them. Collect at least two weeks of reports, and a full month if the client has monthly jobs like invoices or payroll.

2. List every sender

Group the aggregate reports by source IP and by the domain that signed the mail. On a typical small business you'll find:

• Microsoft 365 or Google Workspace (the main mailbox)
• Marketing tools: Mailchimp, HubSpot, Constant Contact
• Accounting and invoicing: QuickBooks, Xero, Stripe receipts
• The CRM or helpdesk
• The copier or scanner doing scan-to-email
• The website's contact form

Anything you don't recognise is either a forgotten tool or someone spoofing the client. Ask the client before you assume.

3. Fix alignment for each legitimate sender

DMARC passes when SPF or DKIM passes and that domain matches the From domain. For each sender:

• Prefer DKIM. Most platforms let you publish their DKIM key on the client's domain (usually a CNAME). DKIM survives forwarding; SPF doesn't.
• SPF where needed. Add the sender's include:, but watch the 10 DNS-lookup limit. Past 10, SPF returns permerror and stops helping DMARC.
• Copiers and old apps. Route them through the main mail system (an authenticated SMTP relay or connector) instead of sending directly.

Done means the reports show each legitimate source passing DMARC for a week or more.

4. Step up, slowly

Check the reports before each step. If a legitimate sender starts failing, go back one step, fix it, and move on again. Each change is a single TXT edit, so it's reversible within the TTL.

5. Don't forget subdomains and parked domains

Set sp= if subdomains need a different policy from the main domain. Domains that never send mail can go straight to reject:

example.net         TXT  "v=spf1 -all"
_dmarc.example.net  TXT  "v=DMARC1; p=reject"

6. Keep watching

p=reject isn't the finish line. The client will add a new tool next quarter and nobody will tell you. Keep reading the reports, so a new failing sender shows up as an alert instead of a support ticket.