23 June 2026 · 6 min read
Done-for-you DMARC enforcement means the platform does the slow part of reaching p=reject: collecting aggregate reports, working out which senders are yours, finding the ones that are not yet authenticated, and telling you when each policy step is safe. On DMARC Engine you still approve every policy change. This page explains what the platform does at each stage, what it checks before it suggests the next step, and what stays your decision.
Why enforcement needs care
Changing p=none to p=reject takes seconds. The risk is that a legitimate service sending as your domain, such as a billing platform, help desk or newsletter tool, is not yet authenticated with alignment. At p=reject, receivers refuse its mail. At p=none, nothing is enforced, so anyone can still spoof your domain.
DMARC passes when SPF or DKIM passes and aligns with the domain in the visible From address. The whole job before enforcement is to get every legitimate sender into that state and prove it with report data. DMARC alignment explained covers the rule itself.
Stage 1: publish p=none and collect reports
When you add a domain, the DMARC record builder starts you at p=none with a rua= address that delivers aggregate reports to DMARC Engine. If DMARC Engine hosts your DMARC record, through a one-time CNAME at _dmarc, saving in the builder publishes it. Otherwise the builder gives you the record to publish at your DNS host.
Receivers then send daily aggregate reports. The platform:
- parses and stores each report;
- labels sending IP addresses from forward-confirmed reverse DNS, so you see names such as your mail provider or marketing platform rather than bare IPs;
- groups each sender into one of four categories: aligned, forwarding, needs work (looks legitimate but is not authenticating) and suspected spoofing.
The first reports usually arrive within 24 to 48 hours of publishing.
Stage 2: fix the senders that are not authenticated
This is the longest stage. For each legitimate sender that fails, the platform raises a recommendation in your Recommendations inbox, for example:
- a provider sending real volume without a DKIM signature for your domain, with setup guidance for common providers such as Google, Microsoft, Zoho and Amazon SES;
- one of your own servers that is missing from SPF;
- a recognised sending service that is not yet in your SPF record. If DMARC Engine hosts your SPF record, you can add it with one click after reviewing the new record and its DNS lookup count.
These recommendations are the blockers. While any of them is open, the platform will not suggest moving to enforcement, because that sender would start failing. You can dismiss one that does not apply, and a dismissed recommendation stops blocking.
Two related services help here. Hosted SPF flattens your record to keep it under the ten-lookup limit as providers change their addresses, and hosted DKIM generates keys, manages selectors and handles rotation.
What stays your decision: whether an unfamiliar sender is really yours. The platform can tell you an IP belongs to a marketing platform; only you know whether you use it.
Stage 3: the readiness checks
The platform judges readiness on your legitimate mail only. Suspected spoofing is excluded, so attackers cannot hold your rollout back, and a domain that only ever sees spoofed mail is treated as ready immediately, since enforcement can break nothing.
The ladder the platform shows you:
| Stage | Meaning |
|---|---|
| Observing | At p=none, fewer than 100 legitimate messages reported. Too little to judge |
| Authenticate | Blockers are open, or under 95% of legitimate mail aligns |
| Ready to start enforcing | No blockers and at least 95% of legitimate mail aligns |
| Holding at quarantine | At p=quarantine, not yet clear for p=reject |
| Ready for reject | No blockers and at least 98% of legitimate mail aligns |
| Enforced | At p=reject |
The percentages are working thresholds, not rules from the DMARC standard. The real question at each step is whether the mail that still fails is mail you want, and the reports let you check that.
Stage 4: quarantine, then reject, with optional testing
When a domain is ready, the plan offers an Advance button that opens the record builder with the next policy filled in. You review the record and publish it.
At each step you can test first. The current DMARC standard, RFC 9989, replaced the old pct= sampling tag with a test flag, t=y, which asks receivers to apply one level less than the published policy: p=quarantine; t=y is treated as p=none, and p=reject; t=y as p=quarantine. The platform shows a domain in test mode as testing, never as enforced, and tells you when it is clear to remove the flag.
RFC 9989 suggests at least a month at p=none and a similar period at p=quarantine. It also says domains whose users post to mailing lists SHOULD NOT publish p=reject, so for some domains p=quarantine is the right place to stop. p=none vs quarantine vs reject explains the trade-off.
After p=reject
Enforcement is not the end. A new marketing tool, a changed provider or an acquisition can add a sender that is not authenticated, and at p=reject its mail is refused. The platform keeps reading your reports after enforcement and alerts you to regressions, so a new failing sender shows up as a recommendation instead of as missing mail.
What the platform does, and what you decide
| The platform | You |
|---|---|
| Collects and parses aggregate reports | Decide which domains to manage |
| Labels and groups every sender | Confirm which unfamiliar senders are yours |
| Raises recommendations for unauthenticated senders | Fix them at the provider, or apply one-click SPF fixes |
| Judges readiness on legitimate mail | Approve and publish each policy change |
Offers t=y test steps | Choose the pace, and where to stop |
| Keeps watching after enforcement | Respond to new recommendations |
No policy change is published without your approval. That is deliberate: automatic enforcement on a timer would be faster, and it could reject your own mail.
Where to start
Run your domain through the DMARC checker to see your current policy. If you already have aggregate reports, the DMARC report analyser shows which senders align. Hosted DMARC covers the record, the staged policy and the report ingestion described above.