From p=none to p=reject, in the safe order

p=none asks receivers to deliver everything as before and send you reports. It changes nothing for your mail, which makes it safe to publish today.

Leave p=none in place for two to four weeks so the reports cover a full business cycle, including month-end invoicing and any scheduled campaigns. List every service that sends as you: your mailbox provider, your CRM, your helpdesk, your billing tool, your website forms, your marketing platform.

Some will be services you forgot. Some will be servers you do not recognise. Work out which are legitimate before you move on.

For each legitimate sender that fails, make SPF or DKIM pass and align. DKIM is the more reliable choice for third-party services because it survives forwarding. Add the DNS records the service gives you, then check that the next reports show a pass.

Look at your last 30 days and ask: if the policy had been stricter, which real messages would have been held? If the answer is none, you are ready. If not, fix those senders first.

p=quarantine asks receivers to treat failing mail as suspicious, usually by sending it to spam. Mistakes at this stage are recoverable, because messages are still delivered, only to a different folder. Many teams also use the pct tag to apply the policy to a share of mail first, if their receivers support it.

When quarantine has run cleanly for a few weeks, change the policy to p=reject. Receivers now refuse failing mail outright.

Parked domains and old domains that never send mail are an easy target for forgery. Publish v=spf1 -all and a DMARC record at p=reject on them. There is nothing to break, and it removes the risk.