# How to Move DMARC from p=none to p=reject Without Blocking Your Own Email (2026)

> A third of company domains in the DACH region sit on DMARC p=none, which protects nothing. Here is the safe path to quarantine and reject: inventory every sender, fix alignment, tighten in stages.

Source: https://knkoutbound.com/blog/dmarc-reject-umstellen/  
Author: Kenneth Kather, Founder & CEO, KNK Outbound  
Published: 2026-10-24

## Key takeaways

- p=none only monitors: receivers deliver spoofed mail as normal. Protection starts with p=quarantine (spam folder) and p=reject (refused), which only 41.7% of 23,488 DACH company domains use.
- Before tightening, list every service that sends with your domain in the From address, from Microsoft 365 to the CRM, newsletter tool, invoicing and the website form, and make each one pass SPF or DKIM aligned with your domain.
- Tighten in stages: p=none with a report address for two to four weeks, then quarantine, optionally ramped with pct, then reject once the reports show only known senders.
- Forwarding and mailing lists break SPF but usually keep DKIM intact, so DKIM signing with your own domain is what keeps legitimate mail flowing under p=reject.

## The short answer

To move DMARC from p=none to p=reject safely, first collect DMARC reports for two to four weeks, identify every service that sends email with your domain, and make each one pass SPF or DKIM in alignment with your domain. Then switch to p=quarantine, watch the reports for another two to four weeks, and finally set p=reject. Done in that order, you block spoofed mail without blocking your own invoices, newsletters or sales emails.

It matters because most companies never take the second step. In our [DMARC adoption statistics](https://knkoutbound.com/dmarc-adoption-statistics/) covering 23,488 company domains in Germany, Austria and Switzerland, 33.1% sit on p=none and only 41.7% enforce DMARC at all. And 15.5% of all domains run p=none without even a report address, so they neither protect nor see anything.

## What the three policies actually do

DMARC tells receiving servers what to do with a message that claims to come from your domain but fails authentication. The policy is the p tag in the TXT record at _dmarc.yourdomain.com.

| Policy | What receivers do with failing mail | Protection against spoofing | Typical use |
|---|---|---|---|
| p=none | Deliver as normal, send reports | None | Start phase, inventory |
| p=quarantine | Deliver to the spam folder | Partial | Transition, after clean reports |
| p=reject | Refuse the message | Full | Target state |

A message passes DMARC when SPF or DKIM passes and the domain that passed matches the domain in the visible From address. That match is called alignment, and it is where most problems hide: a newsletter tool can pass SPF for its own domain and still fail DMARC for yours.

## Step 1: Find every service that sends as you

Make a list of everything that puts your domain into the From line. In a typical mid-sized B2B company that is more than people expect:

- the mailbox platform, usually Microsoft 365 or Google Workspace
- the CRM and its sequences, for example HubSpot
- the newsletter or marketing automation tool
- invoicing, accounting and the ERP system
- the website contact form and the shop
- ticketing, recruiting and HR tools
- copiers and scanners that send by email

The DMARC reports from the next step complete this list. Anything you find there that nobody can explain is either a forgotten tool or someone spoofing you.

## Step 2: Start with p=none and a report address

If you have no DMARC record yet, publish one in monitoring mode:

    v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

The rua address receives daily aggregate reports from Google, Microsoft, Yahoo and many other receivers. They are XML files, so most teams use a DMARC report service with a free tier to turn them into a readable list of senders. How to read them yourself is explained in our guide to [reading DMARC reports](https://knkoutbound.com/blog/dmarc-berichte-lesen/).

## Step 3: Fix alignment for each sender

For every legitimate source in the reports, make it pass in alignment with your domain:

- **DKIM first.** Switch on DKIM signing with your own domain in each tool, usually by publishing two CNAME or TXT records the tool gives you. DKIM survives forwarding, SPF does not.
- **SPF second.** Add the service to your single SPF record with an include, and stay below ten DNS lookups.
- **Move bulk senders to a subdomain** such as news.yourdomain.com if a tool cannot sign with your main domain. The exact records for the big providers are in our [SPF, DKIM and DMARC setup guide](https://knkoutbound.com/blog/spf-dkim-dmarc-einrichten/).

Repeat until the reports show only known sources passing, and the failures that remain come from IP addresses you do not recognise.

## Step 4: Quarantine, then reject

Switch to quarantine once a full week of reports looks clean:

    v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com

If you want a softer ramp, the pct tag applies the policy to a share of failing mail, for example pct=25, then 50, then 100. Keep the report address in place throughout. After another two to four weeks without surprises, set p=reject. Add sp=reject if your subdomains should be covered explicitly, and keep reading the reports, because every new tool someone signs up for is a new sender.

## The pitfalls that block real email

- **Forwarding and mailing lists.** A forwarded message keeps your From address but arrives from another server, so SPF fails. DKIM usually survives, which is why DKIM on every source matters.
- **Tools that sign with their own domain.** The message passes DKIM for the tool, not for you, and fails DMARC. Look for a custom domain or domain authentication setting.
- **Forgotten senders.** The scanner in the office or an old web server sending password resets. The reports show them, but only if someone reads them.
- **A second SPF record.** Two SPF records make SPF fail every time and drag DMARC with it.

## Where cold email fits in

DMARC on your main domain protects your brand. For outbound, we never send cold email from the main domain at all. We set up separate sending domains, each with its own SPF, DKIM and DMARC, before the first email goes out, as described in our guide to [cold email infrastructure](https://knkoutbound.com/blog/cold-email-infrastructure-domains-inboxes/). That way a campaign never puts the domain your customers and invoices depend on at risk. If you want that built and run for you, see our [cold email agency](https://knkoutbound.com/cold-email-agency/).

To see where your domain stands right now, run our free [email deliverability check](https://knkoutbound.com/email-deliverability-check/). It shows your current DMARC policy, whether a report address is set and what is missing.

## FAQ

### What does p=none mean in DMARC?

p=none is monitoring mode. Receivers deliver mail that fails SPF and DKIM as normal and only send reports to the rua address. It is the right starting point, but it gives no protection against someone sending email in your name.

### Should I use p=quarantine or p=reject?

p=reject is the target, because it refuses spoofed mail outright. p=quarantine sends it to the spam folder and is a sensible intermediate step while you confirm that all legitimate senders pass. Most companies stay on quarantine for two to four weeks before moving to reject.

### How long should I stay on p=none?

Long enough to see every sender, usually two to four weeks of daily reports. Monthly tools such as invoicing or newsletters only appear when they send, so cover at least one full billing and newsletter cycle before tightening.

### Can p=reject block my own emails?

Yes, if a legitimate service sends with your domain in the From address and passes neither SPF nor DKIM in alignment with your domain. That is why you fix every sender found in the reports before switching, and keep reading reports afterwards.

### Does DMARC p=reject improve deliverability?

Indirectly. Gmail, Yahoo and Microsoft require a DMARC record from bulk senders, and p=none is enough for that. An enforced policy mainly protects your brand from spoofing, which also protects the reputation of your domain over time.

## About KNK Outbound

KNK Outbound builds and runs outbound systems for B2B companies in Europe and the US: cold email, LinkedIn, content and ads, fully done for the client, including reply handling. From EUR 3,300 a month, all-inclusive (tools, data, domains, mailboxes), three-month build phase, then monthly. Pricing: https://knkoutbound.com/pricing/ · Book a call: https://knkoutbound.com/book-a-call/ · Agent access (MCP): https://knkoutbound.com/mcp