DMARC Enforcement Migration — From p=none to p=reject in 90 Days

Why staged migration#

Jumping straight to p=reject (strict enforcement) is risky:

• If your SPF or DKIM has any misconfigurations, your own mail gets rejected
• Forwarded mail (newsletters → mailing lists → recipient inboxes) often fails SPF — sudden rejection means lost engagement
• Third-party services that legitimately send-on-behalf (Salesforce, Marketo, AcelleMail itself) may not be in your SPF — sudden rejection breaks integrations

The staged migration: p=none (monitor) → p=quarantine (junk folder) → p=reject (bounce). 30 days at each stage. Validate before stepping up.

Stage 1: p=none (Days 0-30)#

Publish:

TXT _dmarc.yourdomain.com  "v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1; pct=100"

What happens:

• Receivers send you aggregate reports daily (via rua=) — each contains: SPF/DKIM pass rate per source IP, per sending domain
• Failed messages still arrive in recipient inboxes — p=none doesn't enforce, just observes
• You discover surprises: forgotten third-party senders, mis-aligned envelope-senders, broken DKIM signing

Monitor:

1. Read the daily DMARC aggregate reports (XML files; use a parser)
2. In AcelleMail, watch the bounce log for any 5.7.x DSN codes (auth issues):

3. Check your sending-server auth chips remain green:

The auth chips on the sending-server detail#

Open Settings → Sending servers → click your active server. The toolbar shows the live SPF / DKIM / DMARC chip status:

• Green chips on all three = receiving servers can confirm you're authorized to send from this domain.
• Any chip red = receiving servers immediately downgrade reputation. Click Verify domain in the toolbar to walk through the DNS-fix wizard.

Validate before Stage 2:

• DMARC pass rate ≥99% in aggregate reports (last 7 days)
• No unauthorized "spoofing" sources in aggregate (all source IPs are recognized as yours)
• No 5.7.x bounce-spike in AcelleMail

If pass rate <99%: investigate the failing sources before proceeding.

Stage 2: p=quarantine (Days 30-60)#

Update to:

TXT _dmarc.yourdomain.com  "v=DMARC1; p=quarantine; rua=mailto:[email protected]; fo=1; pct=100"

What happens:

• Failed-DMARC messages now go to recipient's Junk folder (not Inbox)
• Legitimate but mis-aligned messages start visibly degrading — engagement drops on poorly-authenticated sources
• Aggregate reports continue daily

Monitor:

1. Pass rate should stay ≥99% (your fixes from Stage 1 took effect)
2. AcelleMail's bounce log: 5.7.x rate should be near 0%
3. Open rate / click rate on your campaigns — should be flat (not dropping due to junk-foldering)

Validate before Stage 3:

• 14 consecutive days at pass rate ≥99.5%
• No customer complaints about "missing emails" routed to spam
• Aggregate reports show NO unauthorized sources

Stage 3: p=reject (Day 60+)#

Update to:

TXT _dmarc.yourdomain.com  "v=DMARC1; p=reject; rua=mailto:[email protected]; fo=1; pct=100"

What happens:

• Failed-DMARC messages are now BOUNCED — neither inbox nor junk
• Maximum enforcement; phishing attempts using your domain hit the wall
• Receiving servers reject at SMTP level (visible in your bounce log if you misconfigure)

Monitor:

1. Pass rate should remain ≥99.5%
2. Watch for any third-party-sender issues you missed (Salesforce, Mailchimp, etc. — if they send-as-you and weren't authorized)
3. Customer complaint volume

This is the target state. BIMI requires this stage (or quarantine minimum) before logos display.

Rollback criteria#

If at any stage:

• DMARC pass rate <99% AND you can't identify the failing source
• Customer complaints about "emails going to spam" spike
• Critical third-party-sender stops working

Roll back to previous stage. Update DNS to previous p= value. Wait 24-48h for cache propagation.

Diagnose the failure, fix, then re-attempt the step-up.

Reading DMARC aggregate reports#

Aggregate reports arrive at your rua= address as XML (often zipped). Sample:

<feedback>
  <policy_published>
    <domain>yourdomain.com</domain>
    <p>quarantine</p>
  </policy_published>
  <record>
    <row>
      <source_ip>54.240.0.10</source_ip>
      <count>1247</count>
      <policy_evaluated>
        <disposition>none</disposition>
        <dkim>pass</dkim>
        <spf>pass</spf>
      </policy_evaluated>
    </row>
    <identifiers>
      <header_from>yourdomain.com</header_from>
    </identifiers>
    <auth_results>
      <dkim>
        <domain>yourdomain.com</domain>
        <result>pass</result>
      </dkim>
      <spf>
        <domain>yourdomain.com</domain>
        <result>pass</result>
      </spf>
    </auth_results>
  </record>
  ...
</feedback>

Parse via:

• dmarcian.com (free tier)
• dmarcanalyzer.com (free tier)
• EasyDMARC (free trial + paid)
• Postmark DMARC Digests (free; daily email digest)
• Manual XML parse (DIY; possible but tedious)

The free / freemium tools show:

• Per-source-IP send volume + pass rate
• Unauthorized senders trying to use your domain (phishing attempts)
• Per-recipient-domain breakdown (Gmail vs Outlook vs Yahoo)

Common DMARC migration issues#

What pct= does#

pct=50 applies the policy to 50% of failing messages, lets 50% through. Useful for gradual rollout within a stage:

Week 1 of p=quarantine: pct=10  (10% to junk, 90% to inbox)
Week 2: pct=25
Week 3: pct=50
Week 4: pct=100  (full quarantine)

If problems surface, dial back without losing the staged-rollout progress.

TXT _dmarc.brand.com         "v=DMARC1; p=quarantine; sp=reject; ..."
                                                    ^^^^^^^^^^
                                                    Subdomain policy

TXT _dmarc.mail.brand.com  "v=DMARC1; p=quarantine"

ARC-Authentication-Results: i=1; ...
ARC-Seal: i=1; a=rsa-sha256; ...
ARC-Message-Signature: ...

#!/bin/bash
# Daily aggregate report processor
# Pulls DMARC reports from inbox, parses, aggregates pass-rate

mailbox_check_dmarc_reports
parse_xml_reports
calculate_pass_rate_last_24h

if [ $pass_rate -lt 99 ]; then
  notify_slack "DMARC pass rate dropped to $pass_rate% — investigate"
fi

if [ $pass_rate -ge 99 ] && [ "$current_policy" = "none" ] && [ $days_at_stage -ge 30 ]; then
  notify_slack "Stage 1 complete — ready to step up to p=quarantine"
fi

Week 1: pct=5
Week 2: pct=10
Week 3: pct=25
Week 4: pct=50
Week 5: pct=75
Week 6: pct=100

Related articles#

• Complete DNS setup for email sending
• SPF record deep dive
• How to set up SPF, DKIM, and DMARC records
• BIMI setup — show your logo in Gmail
• Return-path and envelope-sender explained