What p=reject does
With p=reject, you tell every inbox provider: if an email claims to be from my domain and fails the checks, refuse it. Fake invoices and phishing emails using your exact address stop arriving. It also builds trust in your real mail.
Why jumping straight there breaks email
Most businesses have more senders than they think. If your invoicing system, CRM or website contact form sends as your domain but isn't set up with SPF and DKIM, p=reject will block those emails too, and nobody will tell you. That's why the move happens in stages.
The stages, and how long each takes
| Stage | Record | Typical time |
|---|---|---|
| 1. Watch | p=none | 2–4 weeks |
| 2. Quarantine some | p=quarantine; pct=25 | 1–2 weeks |
| 3. Quarantine all | p=quarantine | 2 weeks |
| 4. Reject some | p=reject; pct=25 | 1–2 weeks |
| 5. Reject all | p=reject | Stay here |
pct= applies the policy to only that percentage of failing email, so any mistake affects a small share of mail. Only move on when the reports show every real sender passing for the whole stage.
Find every legitimate sender
DMARC reports list every server that sent email using your domain. Go through them and match each one to a service you use:
- Your mailbox provider (Microsoft 365, Google Workspace)
- Invoicing and accounting tools
- CRM and newsletter tools
- Helpdesk and booking systems
- Your website, which may send contact form emails
Each one needs SPF and, ideally, DKIM for your domain. Anything you don't recognise and that fails is very likely someone faking you.
How Harbour tells you when it's safe
Harbour reads the daily reports, names the services sending as you, and shows which are passing. When every real sender has passed for long enough, it tells you the next stage is safe and gives you the exact record to paste. If something starts failing after a change, you hear about it the same day.
Questions people ask
Will p=reject stop email going to spam?
It helps, because receivers trust domains that protect themselves, but it mainly stops fakes. Spam placement also depends on content and sending habits.
What about forwarded email?
Forwarding can break SPF. DKIM normally survives, which is one reason to switch DKIM on for every sender.
Can I go back?
Yes. Changing the record back to p=none takes effect as soon as DNS updates.
Keep it fixed
Settings drift. A new mailing tool, a DNS move or an expired key can quietly undo the fix. Harbour reads the daily reports that inbox providers send about your domain and tells you in plain English when something breaks.
Start monitoring