From p=none to p=reject without breaking your own mail

Most domains that publish DMARC stop at p=none and stay there for years. It is an understandable place to stall: none is safe (nothing of yours can break) and the danger of over-tightening is real (your own newsletter in everyone's spam folder is a memorable week). But p=none is surveillance without protection — spoofed mail is reported to you and delivered anyway. The value you published DMARC for arrives only at quarantine and reject. The good news: the path there is staged, observable, and reversible at every step.

Step one: account for every real sender

The only mail enforcement can hurt is your own unaligned mail, so the work is an inventory: every system that legitimately sends as your domain must authenticate with your domain — DKIM signed with your key (not the tool's), SPF where it applies. Your DMARC reports are the inventory tool; a few weeks of them names every sender you forgot existed. The senders to fix are the ones with real volume that align on nothing; the unknown servers whose mail passes are typically forwarders and need no action.

Step two: quarantine, a slice at a time

DMARC has a built-in dial for careful rollouts: pct. Publishing p=quarantine; pct=25 asks receivers to quarantine a quarter of the failing mail — spoof victims see most of it still land in spam-adjacent review rather than inboxes, while anything of yours you missed breaks for only a quarter of its traffic, loudly enough to notice and small enough to survive. Watch the reports for a week or two; if nothing legitimate is failing, raise the percentage, then drop the pct entirely. Quarantine at 100% already removes most of the pain: forged mail stops reaching inboxes.

Step three: reject, and the subdomain question

Reject is quarantine with the ambiguity removed — forged mail is refused during delivery, never seen, and the complaint stops being possible. Take the same staged approach if you like (p=reject; pct=25 and up). One decision people miss: subdomains. Your policy covers them by default, but an explicit sp= lets you run different speeds — common when the apex is clean but some subdomain still sends through a legacy system. And when the reports stay clean at reject: you are done, in the sense that a maintained thing is done — the record needs watching, not revisiting.

When is each step safe? That is a data question

Every step above has a precondition you can read off the reports: aligned share of your own volume, senders still unverified, how recently a legitimate source last failed. Sojka's readiness advisor computes exactly that and answers the only question that matters — "what is between me and the next step" — with the exact record to publish when the answer is nothing. Domains go from none to reject in weeks this way, without a single broken newsletter.

Check your domain free — it reads your public DNS and grades what is there.