# DMARC Enforcement Migration — From p=none to p=reject in 90 Days > Going from no DMARC to p=reject all at once breaks your own legitimate mail. The 3-stage migration (none → quarantine → reject) is the safe path. This guide walks the 90-day plan, what to monitor at each stage, when to roll back. - Canonical URL: https://acellesend.com/kb/articles/dmarc-enforcement-migration - Author: Lena Hart, Email Deliverability Editor - Category: DNS & Domain Setup — SPF, DKIM, DMARC, BIMI, domain verification, MX records, Return-Path - Content type: tutorial · Difficulty: intermediate - Tags: Acellemail - Published: 2026-07-04 · Last updated: 2026-08-15 - Reading time: 7 min - Publisher: AcelleMail Knowledge Base, https://acellesend.com/kb --- ## Why staged migration Jumping straight to `p=reject` (strict enforcement) is risky: - If your SPF or DKIM has any misconfigurations, your own mail gets rejected - Forwarded mail (newsletters → mailing lists → recipient inboxes) often fails SPF — sudden rejection means lost engagement - Third-party services that legitimately send-on-behalf (Salesforce, Marketo, AcelleMail itself) may not be in your SPF — sudden rejection breaks integrations The staged migration: `p=none` (monitor) → `p=quarantine` (junk folder) → `p=reject` (bounce). 30 days at each stage. Validate before stepping up. ## Stage 1: p=none (Days 0-30) Publish: ``` TXT _dmarc.yourdomain.com "v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; ruf=mailto:dmarc-forensic@yourdomain.com; fo=1; pct=100" ``` What happens: - Receivers send you aggregate reports daily (via `rua=`) — each contains: SPF/DKIM pass rate per source IP, per sending domain - Failed messages still arrive in recipient inboxes — `p=none` doesn't enforce, just observes - You discover surprises: forgotten third-party senders, mis-aligned envelope-senders, broken DKIM signing **Monitor:** 1. Read the daily DMARC aggregate reports (XML files; use a parser) 2. In AcelleMail, watch the bounce log for any 5.7.x DSN codes (auth issues): ![Bounce log — DSN reasons](https://acellesend.com/plugins/acelle/landing/images/help/kb/smtp-error-codes/01-bounce-log-mixed.png) 3. Check your sending-server auth chips remain green: ### The auth chips on the sending-server detail Open Settings → Sending servers → click your active server. The toolbar shows the live SPF / DKIM / DMARC chip status: ![Sending server detail with auth chips](https://acellesend.com/plugins/acelle/landing/images/help/kb/spam-folder/02-sending-server-config.png) - **Green chips on all three** = receiving servers can confirm you're authorized to send from this domain. - **Any chip red** = receiving servers immediately downgrade reputation. Click *Verify domain* in the toolbar to walk through the DNS-fix wizard. **Validate before Stage 2:** - DMARC pass rate ≥99% in aggregate reports (last 7 days) - No unauthorized "spoofing" sources in aggregate (all source IPs are recognized as yours) - No 5.7.x bounce-spike in AcelleMail If pass rate <99%: investigate the failing sources before proceeding. ## Stage 2: p=quarantine (Days 30-60) Update to: ``` TXT _dmarc.yourdomain.com "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com; fo=1; pct=100" ``` What happens: - Failed-DMARC messages now go to recipient's Junk folder (not Inbox) - Legitimate but mis-aligned messages start visibly degrading — engagement drops on poorly-authenticated sources - Aggregate reports continue daily **Monitor:** 1. Pass rate should stay ≥99% (your fixes from Stage 1 took effect) 2. AcelleMail's bounce log: 5.7.x rate should be near 0% 3. Open rate / click rate on your campaigns — should be flat (not dropping due to junk-foldering) **Validate before Stage 3:** - 14 consecutive days at pass rate ≥99.5% - No customer complaints about "missing emails" routed to spam - Aggregate reports show NO unauthorized sources ## Stage 3: p=reject (Day 60+) Update to: ``` TXT _dmarc.yourdomain.com "v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourdomain.com; fo=1; pct=100" ``` What happens: - Failed-DMARC messages are now BOUNCED — neither inbox nor junk - Maximum enforcement; phishing attempts using your domain hit the wall - Receiving servers reject at SMTP level (visible in your bounce log if you misconfigure) **Monitor:** 1. Pass rate should remain ≥99.5% 2. Watch for any third-party-sender issues you missed (Salesforce, Mailchimp, etc. — if they send-as-you and weren't authorized) 3. Customer complaint volume **This is the target state.** BIMI requires this stage (or quarantine minimum) before logos display. ## Rollback criteria If at any stage: - DMARC pass rate <99% AND you can't identify the failing source - Customer complaints about "emails going to spam" spike - Critical third-party-sender stops working **Roll back to previous stage.** Update DNS to previous `p=` value. Wait 24-48h for cache propagation. Diagnose the failure, fix, then re-attempt the step-up. ## Reading DMARC aggregate reports Aggregate reports arrive at your `rua=` address as XML (often zipped). Sample: ```xml yourdomain.com

quarantine

 54.240.0.10 1247 none pass pass yourdomain.com yourdomain.com pass yourdomain.com pass ... ``` Parse via: - **dmarcian.com** (free tier) - **dmarcanalyzer.com** (free tier) - **EasyDMARC** (free trial + paid) - **Postmark DMARC Digests** (free; daily email digest) - **Manual XML parse** (DIY; possible but tedious) The free / freemium tools show: - Per-source-IP send volume + pass rate - Unauthorized senders trying to use your domain (phishing attempts) - Per-recipient-domain breakdown (Gmail vs Outlook vs Yahoo) ## Common DMARC migration issues | Symptom | Likely cause | Fix | |---|---|---| | Pass rate stuck at 90-95% in Stage 1 | Third-party sender not in your SPF | Add to SPF: `include:vendor.com` | | Pass rate drops on weekends | Weekly automation script sends from unauthorized IP | Identify in aggregate report; whitelist or fix | | AcelleMail sends pass; Mailchimp sends fail | Mailchimp's DKIM doesn't sign with your domain | Set up Mailchimp's "authenticate your domain" feature | | Aggregate reports say "DKIM domain mismatch" | DKIM signing different domain than From: header | Ensure consistent domain alignment | | Forwarded mail through old mailing-list fails | Forwarders break SPF | Move to DKIM-aligned sending OR set up ARC at the forwarder | | Customer complaint: legitimate email in spam | Premature `p=quarantine` step | Roll back to `p=none`; investigate; resume | ## What `pct=` does `pct=50` applies the policy to 50% of failing messages, lets 50% through. Useful for gradual rollout within a stage: ``` Week 1 of p=quarantine: pct=10 (10% to junk, 90% to inbox) Week 2: pct=25 Week 3: pct=50 Week 4: pct=100 (full quarantine) ``` If problems surface, dial back without losing the staged-rollout progress.
Advanced: subdomain DMARC policies + ARC for forwarding + multi-tenant DMARC at scale **Subdomain DMARC policies:** The apex `_dmarc.brand.com` record applies to ALL subdomains by default. To override per-subdomain: ``` TXT _dmarc.brand.com "v=DMARC1; p=quarantine; sp=reject; ..." ^^^^^^^^^^ Subdomain policy ``` The `sp=` parameter sets the subdomain policy. Useful for strict subdomain enforcement (transactional subdomain) while keeping the apex at quarantine. For explicit per-subdomain DMARC: ``` TXT _dmarc.mail.brand.com "v=DMARC1; p=quarantine" ``` Overrides whatever the apex DMARC says for `mail.brand.com` specifically. **ARC (Authenticated Received Chain) for forwarders:** When email is forwarded (e.g. recipient's filter forwards to another address), the original SPF + DKIM can break. ARC records the original auth state so the final receiver knows it was legit at the original hop. ``` ARC-Authentication-Results: i=1; ... ARC-Seal: i=1; a=rsa-sha256; ... ARC-Message-Signature: ... ``` If you operate a mailing list / forwarder, configure ARC on your relay. AcelleMail signs ARC automatically when relevant. **Multi-tenant DMARC at scale:** For SaaS platforms sending on behalf of many customers, each customer's domain needs its own DMARC. The platform doesn't manage customer DMARC directly — customers do — but the platform must: 1. Provide each customer with proper SPF includes 2. Ensure DKIM signing uses customer's domain 3. Document the staged migration process (this article!) for customer guidance Some platforms offer "managed DMARC" — paid feature where the platform monitors customer DMARC reports and adjusts policies. **DMARC monitoring automation:** ```bash #!/bin/bash # Daily aggregate report processor # Pulls DMARC reports from inbox, parses, aggregates pass-rate mailbox_check_dmarc_reports parse_xml_reports calculate_pass_rate_last_24h if [ $pass_rate -lt 99 ]; then notify_slack "DMARC pass rate dropped to $pass_rate% — investigate" fi if [ $pass_rate -ge 99 ] && [ "$current_policy" = "none" ] && [ $days_at_stage -ge 30 ]; then notify_slack "Stage 1 complete — ready to step up to p=quarantine" fi ``` **Phasing in `pct=` for ultra-conservative rollout:** ``` Week 1: pct=5 Week 2: pct=10 Week 3: pct=25 Week 4: pct=50 Week 5: pct=75 Week 6: pct=100 ``` 12-week journey from p=none → p=reject with maximum conservatism. Reasonable for risk-averse industries (financial services, healthcare). **DMARC SaaS platforms:** If managing DMARC across 5+ domains: - **EasyDMARC** — comprehensive, $50-200/month - **DMARCLY** — budget-friendly, $20-100/month - **Red Sift OnDMARC** — enterprise, $200+/month - **Postmark DMARC Digests** — free; daily email summary Most provide one-pane visibility + automated alerts + recommendations.
## Related articles - [Complete DNS setup for email sending](https://acellesend.com/kb/articles/complete-dns-setup-for-email-sending) - [SPF record deep dive](https://acellesend.com/kb/articles/spf-record-deep-dive) - [How to set up SPF, DKIM, and DMARC records](https://acellesend.com/kb/articles/how-to-set-up-spf-dkim-and-dmarc-records) - [BIMI setup — show your logo in Gmail](https://acellesend.com/kb/articles/bimi-setup-show-your-logo-in-gmail) - [Return-path and envelope-sender explained](https://acellesend.com/kb/articles/return-path-and-envelope-sender-explained) --- ## Related articles - [BIMI with VMC — Cost, Process, and Whether It's Worth It](https://acellesend.com/kb/articles/bimi-with-vmc-cost-walkthrough): VMC (Verified Mark Certificate) costs $1,500/yr per domain and takes 4-8 weeks to obtain. This guide walks the cost math, the trademark requirements, the alternative paths, and a decision framework for whether VMC is right for your sending program. - [Return-Path vs Envelope-Sender — What Each Does in AcelleMail](https://acellesend.com/kb/articles/return-path-and-envelope-sender-explained): The "From" address recipients see isn't the address that handles bounces. That's the envelope-sender (also called the return-path or MAIL FROM). This guide separates the three sender concepts and shows where AcelleMail configures each. - [My Domain Shows "Pending" — DNS Propagation Explained](https://acellesend.com/kb/articles/dns-propagation-explained): You published your SPF/DKIM/DMARC records but AcelleMail still shows the domain as Pending. That's almost always normal DNS propagation. Here's what's happening and exactly what to do. - [How to Set Up SPF, DKIM, and DMARC Records — The Basics](https://acellesend.com/kb/articles/how-to-set-up-spf-dkim-and-dmarc-records): New to email sending? These are the 3 DNS records you absolutely need before sending a single campaign. This guide is the basics — what each does, what to publish, how AcelleMail verifies them. - [Custom Tracking Domain for Click URLs — AcelleMail Setup](https://acellesend.com/kb/articles/custom-tracking-domain-for-click-urls): By default every link in your emails routes through acellemail.com's tracking redirect. Replace with click.yourdomain.com — same redirect mechanics, your own brand. This guide walks the setup + the CNAME + the link-report verification.