The short version
If you added v=DMARC1; p=none because Outlook.com or Gmail started
refusing your mail, you’ve done the part the mailbox providers asked
for. You haven’t done the part that protects your domain: at p=none,
mail that fails DMARC is delivered as normal, spoofed mail included.
Aim for quarantine by day 30 and reject from day 60, moving each time
the reports say it’s safe.
What p=none does, and doesn’t
p=none asks receivers to send you reports and to deliver mail as
usual. It is the right place to start, because the reports tell you who
sends as your domain before anything is blocked. It is the wrong place to
stay: anyone can still put your domain in the From line of an invoice,
and receivers will deliver it.
The path
Under DMARCbis each step up is two changes: publish the new policy with
t=y (receivers apply one step less while you test), then remove t=y.
| Day | Record | What has to be true first |
|---|---|---|
| 0 | p=none with an rua= report address |
Nothing; it changes no delivery |
| 14 | p=quarantine; t=y |
14 days of reports, at least 100 messages, at least 95% passing, and no sender of yours failing again and again |
| 30 | p=quarantine |
30 days of reports, and the same checks |
| 60 | p=reject; t=y |
30 days at enforced quarantine, at least 500 messages, at least 98% passing |
| 67 | p=reject |
A week of testing reject with nothing of yours failing |
These are the checks DMARCLoop’s adviser runs before it suggests each step; the help centre’s 14-day review and 30-day review give the detail. They are minimums: a domain that sends little mail takes longer to reach the message counts, and that’s fine.
Days 0 to 14: find every sender
The first fortnight is an inventory. The reports list every server that sent mail as your domain, and most domains find a sender they’d forgotten: the invoicing tool, the helpdesk, the CRM that emails customers “from” you. Each one needs SPF or DKIM that passes for your domain, not for its own. That’s the work of auditing third-party senders, and on Microsoft 365 it usually includes turning on DKIM for your own domain.
Days 14 to 30: quarantine, tested then enforced
Quarantine sends failing mail to the junk folder. That’s why it comes first: if a sender you missed starts failing, its mail is in someone’s junk folder, not gone, and they can tell you. A month of reports covers the monthly senders (payroll, statements, invoices) before you enforce.
Days 30 to 60: let quarantine run
A month at enforced quarantine is the safety net before reject, which can’t be undone: a refused message never reaches anyone’s junk folder. Anything found in junk this month is a sender to fix while the mail is still recoverable. If you have senders that run less often than monthly, such as a quarterly newsletter or an annual renewal notice, stay here until each has sent once.
Day 60 onwards: reject
Test p=reject with t=y for a week, then remove t=y. Before you do,
lower the TTL on the _dmarc record so a rollback takes minutes, and keep
reading the reports: at reject, a new unknown source is a problem to solve
within hours. The risks of moving too early are in
p=reject before every sender is identified.
The DMARC Record Wizard builds the record for each step.