DMARC Policy Progression: From Monitor to Reject

Moving from DMARC monitoring to enforcement is one of the most critical decisions in your email security journey. Done correctly, it protects your domain from spoofing and phishing while maintaining legitimate email flow. Done incorrectly, it can block important business emails and damage your reputation with partners and customers.

This guide provides a step-by-step roadmap for safely progressing your DMARC policy from p=none (monitoring) through p=quarantine (partial enforcement) to p=reject (full enforcement), with specific criteria and checkpoints at each stage.

Understanding the Three DMARC Policies

The Safe Progression Roadmap

Alternative Progression Strategies

Strategy 1: Aggressive Progression (High-Risk Tolerance)

For organizations with simple email infrastructure and high confidence:

• 4 weeks monitoring (p=none)
• 2 weeks quarantine at 100% (p=quarantine)
• 2 weeks reject at 50% (p=reject; pct=50)
• Full reject (p=reject)

Total time: ~2 months

Strategy 2: Conservative Progression (Low-Risk Tolerance)

For organizations with complex email infrastructure or low risk tolerance:

• 8-12 weeks monitoring (p=none)
• 4 weeks gradual quarantine with 10%, 25%, 50%, 100%
• 4 weeks quarantine at 100%
• 8 weeks gradual reject with 10%, 25%, 50%, 75%, 100%

Total time: 6+ months

Strategy 3: Subdomain-First Progression

Enforce on low-risk subdomains first:

1. Set p=reject for subdomains with no legitimate email (e.g., api.yourdomain.com)
2. Progress marketing subdomains (e.g., news.yourdomain.com)
3. Finally, enforce on primary domain

Decision Factors: When to Progress

Handling Progression Issues

Problem: Legitimate Email Starts Failing

Immediate Actions:

1. Identify the source from DMARC reports
2. Contact the service provider or check their documentation
3. Add their SPF include or IP to your SPF record
4. Enable DKIM signing if available
5. Test authentication before widespread deployment

If Urgent: Temporarily roll back to previous policy level while fixing authentication.

Problem: Pass Rate Suddenly Drops

Common Causes:

• New email service deployed without authentication setup
• Third-party service changed infrastructure
• DKIM keys rotated without updating DNS
• SPF record modified incorrectly

Response: Investigate immediately, pause progression if needed, fix authentication issues before continuing.

Problem: Increased Spoofing Attempts Detected

This is actually a success indicator! Your DMARC reports are now showing attempted spoofing that would have previously gone undetected.

Action: Document the attempts, continue progression. This validates the need for enforcement.

Progression Checklist

Use this checklist before advancing to the next policy level:

Conclusion

DMARC policy progression is a marathon, not a sprint. The total timeline from p=none to p=reject typically takes 3-6 months for most organizations. While this may seem slow, it's necessary to ensure:

• All legitimate email sources are properly authenticated
• No business disruption occurs
• Stakeholders are informed and prepared
• Your domain gains maximum protection against spoofing

Remember: It's always better to progress slowly and safely than to rush and block legitimate email. The end goal—full DMARC enforcement at p=reject—is worth the careful journey.