Moving to DMARC p=reject Without Breaking Your Mail

The report-driven path from p=none to full enforcement - and the alignment trap that breaks it.

By Henry Timmes · Email Deliverability Consultant · Named contributor to RFC 7489 & RFC 9989 (DMARC)
DMARCp=rejectEmail AuthenticationAlignment
Henry Timmes
Henry Timmes Email Deliverability Consultant · Named contributor to RFC 7489 & RFC 9989 (DMARC)

The report-driven path from p=none to full enforcement - and the alignment trap that breaks it.

This guide is written by Henry Timmes, named as a contributor to RFC 7489 and its successor RFC 9989 - the IETF standards that define DMARC.

Why This Needs Care

Moving to p=reject is the goal - it stops anyone spoofing your exact domain. But flip to reject before every legitimate sender aligns and you will block your own invoices, your CRM, your help desk. The entire skill is getting to reject without a single legitimate message caught in the net.

The Safe Migration Path

The sequence below usually spans several weeks, driven by what your DMARC reports show rather than by the calendar.

The Alignment Trap

A source can pass SPF or DKIM and still fail DMARC because it doesn't align - the authenticated domain differs from your visible From domain. Many ESPs sign with their own domain by default. Fixing alignment usually means configuring the service to sign with (or send from) your domain, often via a custom DKIM and a custom return-path. Your reports will show which sources are passing authentication but failing alignment.

Frequently Asked Questions

How do I move to DMARC p=reject without breaking my mail?

Start at p=none and collect reports, inventory every sender, align each legitimate source via SPF/DKIM, move to p=quarantine and watch for collateral damage, then set p=reject. Let the reports - not the calendar - drive each step.

Why does a sender pass SPF or DKIM but still fail DMARC?

Because of alignment: DMARC requires the authenticated domain to match the visible From domain. Many ESPs sign with their own domain by default, so you must configure them to sign with or send from yours.

How long does DMARC enforcement take?

Typically several weeks, driven by what the reports reveal. Rushing to reject before every legitimate source aligns is the main cause of self-inflicted blocking.

Emails landing in spam?

Henry Timmes diagnoses why your mail isn't reaching the inbox - Microsoft 365, Gmail, Yahoo and beyond - and maps a practical fix. Book a free 15-minute call, no obligation.

Book a free consultation

Related