DMARC Rollout: From p=none to p=quarantine to p=reject
DMARC is rolled out in stages so a legitimate sender you forgot about does not start losing mail. This page follows Google Workspace's recommended rollout and the policy definitions in RFC 7489, and notes where Google and Yahoo's bulk-sender rules stop and your own security goals begin.
Before you publish anything
As checked on October 30, 2026, Google's rollout guide says to set up DKIM and SPF at least 48 hours before setting up DMARC. DMARC passes only when SPF or DKIM passes and the authenticating domain matches the domain in the From header. If you send from AISend, add and verify your sending domain first so its SPF and DKIM records exist.
Stage 1: p=none with reports (about one week)
_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"Google's guide says messages are delivered normally at p=none, with no risk of rejection or spam-foldering, and that one week is usually enough time for daily reports to cover all your mail streams. Read the reports daily. The aim is a list of every system that sends mail as your domain: your application, your support desk, your billing tool, your marketing platform. Anything legitimate that fails needs SPF or DKIM fixed first.
Google and Yahoo both accept p=none as the minimum for bulk senders, and Yahoo recommends including a rua tag. If your only goal is meeting that minimum, you can stop here. You are not protected against spoofing yet.
Stage 2: p=quarantine on a small percentage
_dmarc.example.com. TXT "v=DMARC1; p=quarantine; pct=5; rua=mailto:dmarc@example.com"Google's guide suggests starting with a small share of messages, for example 10% for a small organization or 1% for a large one, and raising the percentage over time. RFC 7489 defines pct as the percentage of failing mail the policy applies to, from 0 to 100 with a default of 100, and says its purpose is to allow a slow rollout. Under p=quarantine, failing messages go to the recipient's spam folder, where recipients can still find them.
Stage 3: raise pct to 100
Keep reading reports while you raise the percentage in steps. If a legitimate sender starts failing, fix its SPF or DKIM before the next step. Fewer surprises at 100% are worth the extra weeks.
Stage 4: p=reject
_dmarc.example.com. TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"Google's guide says you can use reject instead of quarantine if required, and warns that reject means failing messages are rejected by receiving servers and never delivered. Yahoo's FAQ says that for a domain with p=reject, any message without a proper DKIM signature or SPF alignment is rejected by Yahoo's mail servers. Yahoo also says that if forwarding is part of your mail flow, you should implement ARC.
The policy applies to subdomains too unless you publish an sp tag, per RFC 7489. Check every subdomain that sends mail before moving to reject.
How to see where you are
The free SPF/DMARC checker reports p=none as Monitoring only (a warning) and quarantine or reject as Enforced (a pass), with notes for a missing rua=, a pct below 100 or a different sp=. It reads the DNS record, not your aggregate reports, so it tells you which stage you published, not whether your mail passes. The free DMARC record generator builds the record string.
AISend's 3-day trial is free: 500 emails, no card, one verified domain. Paid plans are charged when you subscribe. AISend is for transactional and consented mail, and sending to anyone other than your own account email requires a verified domain.
Frequently asked questions
How long should I stay on p=none?
Google Workspace's rollout guide says to monitor reports for at least a week, and that one week is usually enough for the daily reports to represent all your mail streams. Stay longer if reports still show legitimate senders failing.
What does pct do in a DMARC record?
Under RFC 7489, pct is the percentage of failing messages the policy applies to. The default is 100. It exists so that domain owners can roll out enforcement slowly.
Do I have to go all the way to p=reject?
Not to meet Google's or Yahoo's bulk-sender requirement, which asks for at least p=none. Quarantine or reject protects your domain from spoofing and is your own decision.
Can p=reject cause my own legitimate email to bounce?
Yes, if a system sending as your domain fails both SPF and DKIM alignment. That is why you read reports at p=none first and raise enforcement in steps.
Sources
More guides
Generate or check your DMARC record
Build a DMARC record, then check what your domain publishes today.