Publishing p=reject on day one is the deliverability equivalent of deploying to production on a Friday. It will work, right up until it silently rejects your invoicing tool, your helpdesk and the notification emails from a system nobody remembers configuring.
The staged rollout exists so you discover those senders while the policy is still harmless.
Stage 1: monitor
Publish at _dmarc.yourdomain.com:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; sp=none; adkim=r; aspf=r
This changes nothing about how your mail is treated. What it does is start aggregate reports arriving from receivers, and those reports are the only complete list of what sends as your domain. Two weeks minimum; four is better if your mail is seasonal.
Use a mailbox you will actually read, or a report parser, raw DMARC aggregate reports are XML and unpleasant by hand.
Stage 2: fix what the reports show
You are looking for legitimate senders that fail. Expect to find some.
| What the report shows | What it means | Fix |
|---|---|---|
| Your sending platform, passing both | Correct | Nothing |
| SPF passes, DKIM fails | Not signing, or wrong selector | Publish the key properly |
| DKIM passes, SPF fails | Usually a third-party envelope sender. Often fine | Leave it if DKIM aligns |
| Both fail, source you recognise | A tool nobody authenticated | Add its DKIM, or move it to a subdomain |
| Both fail, source you do not recognise | Spoofing, or a forgotten integration | Investigate before enforcing |
Do not move on until every source you recognise either passes and aligns, or has been deliberately retired.
Stage 3: quarantine, gradually
p=quarantine; pct=25, then 50, then 100, a week or so apart. pct is what makes this safe: at 25% only a quarter of failing mail is quarantined, so a mistake is visible and survivable rather than total.
Watch two things at each step: the reports, for new failing sources, and your own inbound. If internal mail starts landing in junk, something in your own stack is unaligned.
Stage 4: reject
p=reject; pct=100; sp=reject. Failing mail is now refused outright, which is the point: nobody can spoof your From address to your prospects.
Set sp= explicitly. Subdomains inherit the organisational policy by default, and a forgotten subdomain sending transactional mail is the classic way a reject policy breaks something two months later.
Notes specific to cold email
Do it per sending domain. Twelve lookalike domains need twelve records. This is entirely mechanical and entirely skipped, which is why bulk DNS management matters more here than on a single corporate domain.
Alignment usually rests on DKIM. Third-party SPF alignment frequently fails by design, so make sure DKIM signs with your domain rather than your provider’s. More on alignment.
Reject does not improve placement. It stops impersonation and it satisfies bulk-sender expectations. It does not make cold email land, the things that decide that are elsewhere.
Next: checking an existing record, or grading all four records at once.
Frequently asked questions
How long should a DMARC rollout take?
Two to four weeks at p=none to gather reports, then a week or so at each quarantine percentage step, then reject. Six to eight weeks end to end is normal.
What is the pct tag for?
It applies the policy to only a percentage of failing mail. Stepping 25, 50, 100 makes a mistake visible and survivable rather than total.
Do I need to set sp?
Yes, explicitly. Subdomains inherit the organisational policy by default, and a forgotten subdomain sending transactional mail is the usual way a reject policy breaks something later.
What if SPF fails but DKIM passes?
That is common and usually fine. It normally means a third party is the envelope sender. DMARC passes on either mechanism, so aligned DKIM is enough.
Does p=reject improve deliverability?
No. It prevents impersonation of your From address and meets bulk-sender expectations. Placement is decided by list quality, volume pacing and reputation.