Moving from p=none to p=reject without breaking your own mail

DMARC's enforcement policy has three levels: p=none (monitor only, take no action), p=quarantine (send failing mail to spam), and p=reject (block it outright). Jumping straight to p=reject before you're confident every legitimate sender for your domain passes authentication is the single most common way DMARC rollouts break real mail.

Start with p=none and actually read the reports

p=none does nothing to delivery, it just tells receiving mail servers to send you aggregate reports on who's sending mail claiming to be from your domain, and whether it passes SPF and DKIM. This is the step people skip or ignore, but it's the only way to find every legitimate sender before you start blocking anything: your transactional email provider, marketing platform, any internal tool that sends notification emails, sometimes a forgotten one from years ago that still sends the occasional message.

Move to p=quarantine once the reports are clean

Once aggregate reports show every legitimate sender consistently passing SPF or DKIM alignment, and no unexplained failures, move to p=quarantine. This routes failing mail to spam rather than blocking it outright, a real but recoverable consequence if you missed a legitimate sender, versus reject's outright bounce.

Only then, p=reject

After quarantine has run clean for a meaningful stretch (weeks, not days), with no legitimate mail getting caught, moving to p=reject is safe. At this point you've already validated the full list of senders through two less-destructive stages, reject just closes the loop on anything not on that list, which by now is exactly what you want blocked: spoofed mail, not your own.

The realistic timeline

This isn't a rollout you complete in an afternoon. Give each stage enough time to catch infrequent senders, a monthly internal report tool, an annual renewal notice, anything that doesn't send often enough to show up in a week of aggregate reports but would still break if you moved too fast. A few weeks at each stage is a reasonable floor, not a worst case.