Roll DMARC out in three phases — never jump straight to p=reject.
Phase 1 — Monitor (week 1–4):
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; fo=1;
Collect aggregate reports. MailVitals' DMARC monitoring parses them automatically; otherwise use Postmark or DMARC.org's parser.
Phase 2 — Quarantine (week 5–8):
v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@yourdomain.com;
Quarantine 25% of failing mail. Read reports for unexpected senders — usually a marketing platform that needs SPF/DKIM added.
Phase 3 — Reject (week 9+):
v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com; ruf=mailto:dmarc@yourdomain.com;
Once aggregate reports are clean for 14 days, go to p=reject. Stay there forever.
Subdomain policy: add sp=reject to prevent attackers from using unused subdomains.
Sign in to keep track of what you have read.