DMARC p=none to p=reject in Microsoft 365, Step by Step

Anyone can send a fake invoice from your domain. DMARC block mode stops spoofed invoices without bouncing your real ones.

Anyone on the internet can send an email that claims to come from your company, including a fake invoice that asks your customer to pay a new bank account. DMARC in block mode tells receiving mail servers to refuse that mail. Done in the right order, your real invoices keep arriving.

Most domains with DMARC sit at p=none, which this post calls monitor mode: receivers send reports and take no action. The target is p=reject, or block mode. Microsoft’s guidance for Microsoft 365 is to get every custom domain there gradually, testing along the way so good mail is not rejected by accident.

How DMARC Makes Its Decision

A message passes DMARC when it passes SPF or DKIM and the passing domain matches the domain in the From address. That match is called alignment, and it causes almost every real failure. The policy says what to do with mail that fails: none delivers it, quarantine sends it to junk, reject refuses it.

Step 1: Inventory Everything That Sends as Your Domain

This step decides whether block mode breaks your mail. Microsoft 365 mailboxes are the easy part. The trouble is every other system that puts your domain in the From line.

Marketing and CRM. Newsletters, quote emails, and follow-up sequences usually go out through a third-party service.

Invoicing and accounting. The one that hurts if it breaks, because customers stop getting bills.

Ticketing and help desk. Support replies often send as support@ your domain.

Scanners, copiers, and website forms. Scan-to-email devices using SMTP relay and contact forms sent by your web host are easy to forget.

For each one, find out whether it can DKIM sign with your domain. Microsoft’s troubleshooting guide describes the classic failure: SPF passes for the vendor’s bounce domain, DKIM signs with the vendor’s domain, and DMARC fails because neither matches your From address. The fix is custom DKIM signing at the service. Microsoft also suggests putting bulk email services on a subdomain such as marketing.contoso.com so their problems stay off your main domain.

Step 2: Turn On DKIM for Your Custom Domain

Microsoft 365 needs DKIM signing with your custom domain so the signature aligns with the From address. That takes two CNAME records, selector1._domainkey and selector2._domainkey. Microsoft says the values in its articles are illustrations only, so copy yours from the portal or PowerShell.

In the Defender portal, open Email authentication settings, then the DKIM tab. Select the domain, publish the two CNAMEs it shows, and turn on signing. Enter only selector1._domainkey as the hostname: some DNS hosts append your domain, and a doubled domain leaves the status stuck at CnameMissing.

Connect-ExchangeOnline
Get-DkimSigningConfig | Format-List Name,Enabled,Status,Selector1CNAME,Selector2CNAME

# Only if your domain is not listed: create the keys first
New-DkimSigningConfig -DomainName contoso.com -Enabled $false

# After both CNAME records are published
Set-DkimSigningConfig -Identity contoso.com -Enabled $true

If DKIM will not validate, see our guide to fixing the 550 5.7.26 DKIM error.

Step 3: Clean Up SPF

A domain that sends only from Microsoft 365 needs one SPF TXT record at the root:

v=spf1 include:spf.protection.outlook.com -all

Each outside sender usually adds its own include. SPF allows 10 DNS lookups, and Microsoft counts each include, a, mx, exists and redirect, plus nested includes inside a vendor’s record. Plain ip4 and ip6 entries are free. Over the limit, Microsoft suggests swapping a vendor include for its published IP addresses, or moving services to subdomains that each get their own lookup budget.

Step 4: Publish Monitor Mode and Read the Reports

Add a TXT record with the hostname _dmarc, pointing rua at a mailbox someone actually reads:

v=DMARC1; p=none; rua=mailto:dmarc-reports@contoso.com

Without rua you get nothing: RFC 9989, the current DMARC standard, says receivers must not send aggregate reports to a domain that leaves it out. The XML reports list every server that sent mail as your domain. Check source_ip and count for who sent how much. The results under policy_evaluated show alignment, and the ones under auth_results show the raw pass or fail. A raw pass with an alignment fail means a vendor still needs DKIM with your domain.

You are ready to move on when every source from your inventory shows aligned DKIM or SPF, and the only failures left come from servers you do not recognize. Move on the data, not the calendar.

Step 5: Move to Quarantine

v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@contoso.com

Failing mail now lands in spam or junk. This is the forgiving stage: a sender you missed ends up in a junk folder where someone can find it, rather than bouncing. Keep reading reports and fix anything legitimate that fails.

Many guides, including current Microsoft and Google articles, use a pct tag to apply the policy to a percentage of failing mail. RFC 9989, published on the Standards Track in May 2026, replaces RFC 7489 and removes pct, adding a t=y testing flag instead. Since receivers may follow either version, this plan does not lean on a percentage ramp.

Step 6: Move to Block Mode

v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc-reports@contoso.com

Switch when quarantine reports show no legitimate source failing. Microsoft 365 rejects inbound mail that fails p=reject with a 550 5.7.1 error. The sp tag sets the subdomain policy. Microsoft notes that a domain’s DMARC record already covers every subdomain without its own record, and each sending subdomain still needs its own SPF and DKIM. Microsoft’s order is a low-volume subdomain first and the parent domain last.

Parked Domains Skip the Ramp

Domains that never send mail can go straight to block mode with v=DMARC1; p=reject;. If you do not send from your onmicrosoft.com domain, Microsoft says to add a DMARC record for it in the Microsoft 365 admin center too.

Forwarding and Mailing Lists

Forwarding changes the envelope sender, so SPF often fails on forwarded mail. DKIM survives as long as the body is unchanged, which is why it matters more. Mailing lists that rewrite messages can break DKIM as well. ARC lets an intermediary record the authentication results it saw, and Microsoft 365 supports trusted ARC sealers for inbound services that modify mail in transit.

Verify Each Change

Resolve-DnsName -Name "_dmarc.contoso.com" -Type TXT | Select-Object -ExpandProperty Strings

Then send a test to an outside Gmail or Outlook.com account and open the headers. Authentication-Results should show dmarc=pass, and DKIM-Signature should show d= with your domain. Repeat from each outside service in your inventory.

Rolling Back If Real Mail Breaks

If a legitimate sender starts bouncing, step down one level: reject to quarantine, or quarantine to none. Keep rua in place, find the failing source in the reports, fix its DKIM or SPF, then step back up.

Google and Microsoft Sender Rules

Google’s email sender guidelines require DMARC from senders of 5,000 or more messages a day to Gmail accounts and say the policy can be set to none. Google’s DMARC setup article recommends moving to quarantine or reject over time. No conflict: none is the floor, reject is the destination. Microsoft has published requirements for high-volume senders to Outlook; bulk senders should read it directly.