When is my domain ready for p=reject?

On every plan

Your domain is ready for the next step of its DMARC policy when every source that sends a real share of your mail passes DMARC, enough reports have arrived to judge, and the DMARC, SPF and DKIM checks show no error. The domain's Readiness page applies this rule and names whatever is missing. You reach p=reject one step at a time, and each step needs the rule met again.

Why the policy moves in steps, and what each step does to your mail, is in the DMARC policy guide. This page holds the rule itself.

The rule

Over the last 14 days, ending yesterday:

1. Reports arrived on at least 7 days.
2. Every source that sends at least 1 percent of your mail, or at least 50 messages, passes DMARC at 98 percent or more.
3. Unidentified sources that pass DMARC at least once send under 1 percent of your mail together.
4. The DMARC, SPF and DKIM checks have run and show no error.

Other checks, such as MTA-STS and BIMI, never hold readiness back.

Sources the rule leaves out

An unidentified source that never passes DMARC is left out of the rule. It is probably someone else sending as you, and a stricter policy is what stops it. The page counts these sources in a sentence of their own, so they stay visible.

A source you have named yourself counts as identified. See sources.

What the page can say

• Ready: every condition is met. The page shows the record for the next step, with a link to the record builder.
• Not ready yet: at least one condition is not met. The page says which, and lists the sources below the pass rate with what to do about each.
• Not enough reports yet: the DMARC check has not run, no mail has been reported, or reports arrived on too few days.
• At p=reject: the domain publishes p=reject for all of its mail, outside test mode. There is no further step.
• Publish p=none: the domain publishes no DMARC record. The page skips the rule and says to publish p=none now: it changes nothing for delivery and starts the reports.
• Keep one DMARC record: the domain publishes more than one DMARC record, and mailbox providers apply none of them. The page skips the rule and asks you to remove all but one.

The page works the state out each time you open it. We also record it after each report, after each DNS check and once a day, so that an alert can say when it changes. When a check cannot read the DMARC, SPF or DKIM record, because your DNS did not answer or the check failed, the page keeps the state the domain had and says why. Once a check reads the record again, the state moves on from there, so an outage never raises a second alert that the domain is ready.

The policy ladder

The product suggests one step at a time: p=none → p=quarantine; pct=25 → p=quarantine → p=reject.

The page reads the policy your record publishes from our last DNS check. When no check has run, or the last one could not reach your DNS, it reads the policy the latest report states. A subdomain with no record of its own takes its domain's policy: sp when the domain's record has it, otherwise p.

A policy between two steps counts as the step below it. Quarantine for less than the second step's share of mail still counts as p=none, and reject for part of the mail counts as full quarantine. A record in RFC 9989's test mode, t=y, counts as the policy one level below, which is what mailbox providers that follow RFC 9989 apply: quarantine for reject, and none for quarantine. The page says so, and The policy ladder marks that step as applied now, in test mode. The suggestion is always the next step up from where you are, and its record leaves test mode.

The second step uses pct, from the first DMARC specification, RFC 7489. RFC 9989, which replaced it, lists pct as historic, because mailbox providers rarely applied it accurately except at 0 and 100, and adds a t tag for testing in its place. About pct in the DMARC policy guide says more.

Changing the thresholds

From Pro up, an admin can change the numbers in the rule for each domain, on its Readiness page. Subdomains use the thresholds of their domain. Each number has a range:

The days with reports needed cannot be more than the days the rule looks back.

An alert when you are ready

From Pro up, an alert can tell you when a domain meets the rule for its next step.

Published 27 October 2026 · Checked 27 October 2026