Level: Advanced
Progressing a DMARC policy toward full enforcement is a deliberate, staged process, and jumping straight to reject without proper visibility first risks silently blocking legitimate mail.
Start With p=none to Gather Visibility Only
A monitoring-only policy collects aggregate reports on authentication results across every source claiming to send as your domain, without affecting delivery at all, which is essential before enforcing anything.
Review Reports Thoroughly Before Advancing
Aggregate reports often reveal legitimate but previously unknown sending sources, like a marketing tool or a forgotten internal system, that need to be properly authenticated before enforcement begins.
Move to Quarantine Before Reject, and Consider a Percentage Rollout
Using the pct tag to enforce quarantine or reject on only a portion of traffic initially limits the blast radius of any remaining, unidentified authentication gaps.
Next step: Use the Find DNS Records to monitor your current DMARC record and reporting configuration as you plan each stage of moving toward full enforcement.