Moving DMARC from p=none to p=reject

p=none gets you reports and nothing else: spoofed mail using your domain is still delivered. Enforcement is the goal, but flipping straight to p=reject on a domain with unknown senders will drop real mail from the CRM, the payroll provider, or the printer that emails scans.

Stage 1: collect (2 to 4 weeks)

Publish v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. Read the aggregate reports (or feed them to any report analyser) and list every source sending as your domain. For each one, either enable DKIM signing with your domain, add it to SPF, or decide it is not legitimate.

Stage 2: quarantine a slice

Change to p=quarantine; pct=25. A quarter of failing mail goes to spam. Watch reports for a week for legitimate sources you missed. Increase to pct=100.

Stage 3: reject

Change to p=reject. Also set sp=reject unless subdomains send mail you have not yet aligned. Keep the rua address; reports remain your early warning.

Keep it that way

Enforcement is undone by one DNS edit. Monitoring the record daily is the difference between finding out on the day and finding out from a customer.