Move to a stricter DMARC policy from the readiness page

On every plan

When the domain is ready, its readiness page shows the record for the next policy step. Copy it into your DNS, or publish it from Mailmoni if your Cloudflare account is connected. Move one step at a time, and read the reports between steps.

The steps

Your DMARC policy, the p tag, tells mailbox providers what to do with mail that fails DMARC. Mail that passes is not affected. The policy ladder on the readiness page lists the steps and marks the one you publish now:

p=none: mailbox providers deliver mail as they would without DMARC, and send you reports.
p=quarantine; pct=25: mailbox providers are asked to send part of the failing mail to spam. The pct tag says how much.
p=quarantine: mailbox providers send all failing mail to spam.
p=reject: mailbox providers refuse failing mail.

RFC 9989 retires pct, and some mailbox providers apply it to all failing mail or to none. Plan for this step as if it sends all failing mail to spam. The Learn page explains what RFC 9989 says about pct.

Why the steps come in this order is on the Learn page The DMARC policy, step by step.

Check that the domain is ready

Open the domain and go to Readiness. The page states the rule with this domain's numbers, and whether each condition is met. When every condition is met, it says the domain is ready for the next step. Under that it says:

How many messages failed DMARC in the rule's window, and what share of your mail that is.
How many of them the next step would send to spam, or have refused.
Which source most of them came from.

That mail is the mail the step changes. If it comes from a service you use, fix the service first. Fix a source that fails DMARC shows how.

The page reads the policy your record publishes now, from our last DNS check, or from the latest report when the check could not reach your DNS. A subdomain without a record of its own takes its domain's policy. Three cases change what the page says:

No DMARC record. The page skips the rule and says to publish p=none now. It changes nothing for delivery and starts the reports.
More than one DMARC record. Mailbox providers apply none of them, so the page treats the domain as having no policy and asks you to remove all but one.
Test mode, t=y. Mailbox providers that follow RFC 9989 apply the next lower policy, and the page says so. The policy ladder marks the step that applies as applied now, in test mode. A domain at p=reject in test mode is not counted as at reject.

Publish the next step

On the readiness page, press Copy record to copy the record for the step. Or press Open in record builder to open it on the Records tab, where you can see each change before you publish.
If an admin has connected Cloudflare and the domain is in that account, an admin presses Publish record on the Records tab. Otherwise, publish the record as a TXT record at your DNS host, then press Check now on the domain's DNS tab.

The record for the step changes p and pct, and leaves test mode if your record has t=y. Every other tag of your current record stays as it is, except ri and rf, which RFC 9989 retired. Your reporting address stays in rua, so reports keep arriving at every step. An sp tag keeps its value too: if your record has one, your subdomains stay on their own policy until you change it. A subdomain with no record of its own has a readiness page too. Its step is a record at the subdomain's own name, and your domain's record stays as it is.

After you publish

The readiness page marks the new step as published once our next DNS check sees the record. From Pro up, the alert for a changed DMARC policy tells you when that happens, so a change nobody planned does not go unnoticed.

Then read the reports. The chart on Reports shows what mailbox providers did with your mail: delivered, sent to spam or refused. Wait at least 14 days before the next step. The readiness rule looks back that far by default, so by then every report it reads was sent under the new step.

Step back

If a source you use starts failing, publish the previous step's record again, the same way. When mailbox providers refuse a service's mail or send it to spam, the domain's Home tab opens with a card that says how many of its messages they stopped in the last 30 days, how to fix the service, and where to step back while you fix it if the mail matters now: to p=quarantine when they refused mail, or to p=none when they only sent it to spam. When only your subdomain policy, sp, is that strict, the card names sp. Once the policy in force is already at that step or below, the card says what mailbox providers did in that time and what your policy does now, and does not ask you to step back again. Mailbox providers go back to the previous policy when their cached copy of the newer record expires, after the time the record's TTL sets. Until then, some of them still apply the stricter step. Fix the source, and step up again when the readiness page says the domain is ready.

Published 27 October 2026 · Checked 27 October 2026