The safe path to p=reject
- Week 0: publish
p=nonewith a reporting address. Nothing changes for your email; you start receiving daily reports. - Weeks 1–4: read the reports. Every service that sends as you should pass SPF or DKIM in alignment. Fix any that don't (turn on DKIM in that tool, or add it to SPF).
- Then: move to
p=quarantine, optionally withpct=25and rising, and finallyp=reject.
Reports arrive as XML attachments, often dozens a day. A DMARC report service turns them into readable dashboards.