[{"data":1,"prerenderedAt":219},["ShallowReactive",2],{"seo-verification":3,"blog-dmarc-p-reject-client-domains-agency-staged-rollout-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-dmarc-p-reject-client-domains-agency-staged-rollout-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"publishedAt":20,"updatedAt":21,"category":22,"categories":26,"featuredImage":28,"bgImage":29,"posterImage":30,"relatedSolution":28,"intro":31,"sections":32,"ctaTitle":165,"ctaBody":166,"ctaButton":167,"ctaUrl":168,"relatedPosts":169},526,"dmarc-p-reject-client-domains-agency-staged-rollout",{"fr":12,"en":10,"ar":13,"es":14},"dmarc-passer-p-reject-domaines-clients-agence","dmarc-p-reject-نطاقات-العملاء-للوكالات-على-مراحل","dmarc-p-reject-dominios-de-clientes-agencia-por-fases","Move client domains to DMARC p=reject, in stages","Take each client domain from p=none to p=reject without losing mail: sender inventory from rua reports, alignment, subdomains, a rollout calendar and a client message.",11,0,false,"2026-10-29T00:00:00+00:00","2026-10-29T15:45:55+00:00",{"id":17,"name":23,"slug":24,"color":25,"icon":24},"Business Email","emails","bg-cyan-500\u002F10 text-cyan-400",[27],{"id":17,"name":23,"slug":24,"color":25,"icon":24},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fdmarc-passer-p-reject-domaines-clients-agence-poster.svg","An agency managing twenty client domains cannot leave them on p=none forever, nor flip them all to p=reject on a Friday night. Every client has its own sending tools (newsletter, invoicing, CRM, support), and the first quote that bounces will be blamed on whoever touched the DNS. This guide gives a repeatable method per domain: publish reports, inventory the senders, fix alignment, go through quarantine, then reject. It gives the records for each stage, a calendar, the flows that still break, and the message to send the client, so the residual risk is stated beforehand.",[33,37,40,51,54,86,111,114,117,121,124,151,154,162],{"type":34,"title":35,"body":36},"h2","Why a client portfolio does not move to reject in one step","A single domain can be run by eye. A portfolio cannot: each client has tools the agency does not always know in full. The trigger is often external. Since February 1, 2024, Gmail asks for SPF, DKIM and DMARC from senders of more than 5,000 messages a day, Yahoo sets a similar requirement, and Outlook.com applies comparable rules to high volumes. At both Gmail and Yahoo the floor is a published DMARC record with p=none: these requirements do not ask you to move to reject. What pushes you there is spoofing: a client whose name is used to send fake invoices, or whose real invoices land in spam.\n\nThe risk runs both ways. A reject published too early refuses legitimate mail, and it is you the client will call. The DMARCbis standard (RFC 9989, published in May 2026, replacing RFC 7489) recommends a progression: p=none for at least a month, then p=quarantine for a similar period, comparing the results. The three policies are defined in our guide on \u003Ca href=\"\u002Fblog\u002Fdmarc-p-quarantine-email-delivrabilite\">DMARC p=quarantine\u003C\u002Fa>, and what the new standard changes is in \u003Ca href=\"\u002Fblog\u002Fdmarcbis-rfc-9989-ce-qui-change-email-2026\">DMARCbis\u003C\u002Fa>. Here we cover the work specific to a portfolio: inventory, calendar, communication.",{"type":34,"title":38,"body":39},"Publish p=none with a report address, client by client","For each domain, the first write is a TXT record at `_dmarc.your-domain.com`: `v=DMARC1; p=none; rua=mailto:dmarc@your-domain.com`. p=none changes nothing about delivery; it asks receivers to send you aggregate reports, one compressed XML file per receiver per day. If you centralise the reports of all your clients on an agency address, for example `reports@agency-example.com`, the domain of that address differs from the client's, and the receiver has to check that you agreed. The reporting standard (RFC 9990) provides a TXT record for that at `client-example.com._report._dmarc.agency-example.com`, containing at least `v=DMARC1`. Without it, the receiver ignores the address and you receive nothing. A wildcard record `*._report._dmarc.agency-example.com` authorises all domains at once.\n\nCentralising gives an overview but mixes clients in the same mailbox. One address per client, or sorting by the domain in the `header_from` field, avoids reading one client's reports while looking for another's.",{"type":41,"title":42,"items":43},"ul","Reading a report row: the fields that matter",[44,45,46,47,48,49,50],"**source_ip** — the address that delivered the message; a reverse lookup or the `Received` header of a test message reveals the provider behind it.","**count** — the number of messages in the row; it ranks the work, high volumes first.","**disposition** — what the receiver applied: `none`, `quarantine` or `reject`. Under p=none everything is `none`; the column becomes useful at the next stages.","**dkim** and **spf** — the result evaluated for DMARC, so with alignment. A valid but unaligned DKIM shows up as `fail`.","**header_from** — the domain visible in the From field, the one DMARC protects.","**envelope_from** — the envelope domain (Return-Path) that SPF aligns on; a provider domain here explains an SPF failure.","**Rows with no owner** — an unknown IP with a large `count` is either a forgotten client tool or spoofing: ask the client before concluding.",{"type":34,"title":52,"body":53},"Alignment: why a tool that passes SPF and DKIM still fails","DMARC requires SPF or DKIM to be aligned with the domain in the From field. SPF aligns on the envelope domain (Return-Path), not on the From; DKIM aligns on the `d=` domain of the signature. A newsletter service that sends with its own Return-Path and signs with its own `d=` passes SPF and DKIM on its side and fails DMARC for your client, because neither domain is the From domain. By default alignment is relaxed (`aspf` and `adkim` default to `r`): a subdomain of the same organizational domain is enough. In strict mode (`s`), the domain must be identical. Keep relaxed unless you have a specific need.\n\nThe fix is almost always the same: have the tool sign with the client's domain, by publishing the DKIM CNAME records the provider gives you. One alignment is enough, so the provider's own Return-Path is harmless if DKIM is aligned. When you add an SPF `include:`, count: RFC 7208 limits evaluation to 10 DNS lookups, and beyond that the result is a permanent error (permerror).",{"type":55,"title":56,"headers":57,"rows":61},"comparison","Matrix of third-party senders to align",[58,59,60],"Sender","What the provider supplies","What to publish for the client",[62,66,70,74,78,82],[63,64,65],"Newsletter, bulk e-mailing","DKIM key and sending domain","DKIM CNAME; a dedicated sending subdomain is recommended",[67,68,69],"CRM, marketing automation","DKIM signature in the client's name","DKIM CNAME; SPF `include:` only if the provider requires it",[71,72,73],"Invoicing, online payment","Sending from its own servers","Provider's DKIM CNAME; otherwise, send from a dedicated sending subdomain",[75,76,77],"Helpdesk, tickets","Sending address to validate","DKIM CNAME and validation of the sending domain",[79,80,81],"Main mailbox provider","Documented SPF and DKIM records","SPF `include:` and DKIM key of the mail provider",[83,84,85],"Website (forms, shop)","Sending by the site server or a relay","Authenticated SMTP with the client's domain",{"type":87,"title":88,"steps":89},"steps","The standard calendar for one domain, stage by stage",[90,93,96,99,102,105,108],{"title":91,"body":92},"Week 0: publish p=none","List the domain, then publish `v=DMARC1; p=none; rua=mailto:dmarc@your-domain.com`. Check with `dig +short TXT _dmarc.your-domain.com`. The first reports arrive within 24 to 48 hours.",{"title":94,"body":95},"Weeks 1 to 4: observe and review weekly","The standard recommends at least a month of p=none. Each week, group the rows by provider and fill in the tracking table: sender, volume, aligned or not, legitimate or not.",{"title":97,"body":98},"Fix every legitimate unaligned sender","Publish the provider's DKIM CNAMEs, send a test message to a Gmail mailbox and check for `dmarc=pass` in the header. An abandoned tool is not fixed: it is noted as to be refused.",{"title":100,"body":101},"Weeks 5 to 8: set quarantine","Replace the record with `v=DMARC1; p=quarantine; sp=quarantine; rua=mailto:dmarc@your-domain.com`, for a period comparable to the previous phase. Failures go to spam instead of being refused: the `disposition` column of the reports shows what would be lost.",{"title":103,"body":104},"Do not rely on pct as a safety net","RFC 9989 removed the `pct` tag, judged unreliable outside the values 0 and 100, and added `t=y` to ask that the policy not be applied. Support for `t` by Gmail, Yahoo and Microsoft is not documented to date: do not build a stage on it.",{"title":106,"body":107},"Weeks 9 to 12: move to reject","If quarantine revealed no legitimate sender failing, publish `v=DMARC1; p=reject; sp=reject; np=reject; rua=mailto:dmarc@your-domain.com`. Warn the client the day before, and watch the reports daily for a week.",{"title":109,"body":110},"Keep the review going after reject","Every new tool the client adopts becomes a sender to align. Put it in the support agreement: any new sending tool is declared before it goes live, then added to the tracking table.",{"type":34,"title":112,"body":113},"Subdomains: sp, np and a dedicated sending subdomain","A subdomain with no record of its own inherits the policy of the organizational domain. The `sp` tag sets the policy for existing subdomains, `np` for non-existent ones; without `np` it falls back to `sp`, then to `p` (RFC 9989, tag definitions). On a record published in a subdomain, `sp` is ignored. `np` is recent: a receiver that does not know it ignores it and applies `sp`.\n\nThe typical use is fake subdomains. A fraudster writing from `invoice.client-example.com`, a subdomain that does not exist, is stopped by `np=reject` with no risk to real mail, since nothing legitimate is sent from it. For third-party tools, prefer a dedicated sending subdomain, for example `news.your-domain.com`: the tool is aligned there in relaxed mode, its keys and SPF do not clutter the main domain, and you can tighten the main domain without waiting for that flow. A `_dmarc` record of its own on the subdomain even allows a separate calendar.",{"type":34,"title":115,"body":116},"The flows that break: mailing lists, forwarding, aliases","Some legitimate messages fail DMARC by construction, because an intermediary relays them while keeping the original From. A list that adds a footer invalidates the DKIM signature; a redirect invalidates SPF, because the IP delivering the message is no longer the one the domain authorises. The standard says so plainly (RFC 9989, interoperability section): p=reject can be incompatible with these indirect flows, and domains whose users post to mailing lists should not publish it. ARC (RFC 8617) is cited as an attempted fix, but no method has become widely used. The standard also tells receivers not to reject solely on the basis of p=reject and, absent other analysis, to treat the message as with quarantine: reject is therefore not always applied to the letter, which is no reason to ignore it.\n\nThese cases can be spotted before switching. Look in the reports for rows whose IP belongs to a list relay or a forwarding service, where `spf` and `dkim` fail and the `count` is low but regular. Then ask the client: alumni aliases, an association, an address that redirects to a personal mailbox. For a domain whose addresses are used to post to public lists, stay on quarantine: it is a defensible choice, to be recorded in the tracking table.",{"type":118,"title":119,"body":120},"tip","Prove the result before warning the client","Send a test message from each tool to a Gmail mailbox, open \"Show original\" and look for the `Authentication-Results` line: it should contain `dmarc=pass header.from=your-domain.com`. After the move to reject, an SMTP refusal carries a 5.7.x code and a receiver-specific text. Keep a capture of the refusal message and the matching rua report line: they show the client that the faulty tool had been identified and flagged, not discovered afterwards.",{"type":34,"title":122,"body":123},"The message to send the client before each stage","The client does not need to understand DMARC, but must know what changes, when, and what is expected of them. Four sentences are enough.\n\nSubject: protecting your domain against e-mail spoofing\n\nHello, we are strengthening the protection of your domain your-domain.com against spoofing of your addresses. From [date], messages that claim to come from your domain without being authenticated will be placed in spam, then refused from [next date]. To avoid losing any legitimate mail, could you list for us before [date] every tool that sends e-mail in your name (newsletter, invoicing, CRM, support, website)? A risk remains for mailing lists and address redirections: tell us if you use any.\n\nKeep the reply in the client file: it records who declared which tools, and when.",{"type":55,"title":125,"headers":126,"rows":130},"Portfolio tracking table",[127,128,129],"Domain","Current policy and next stage","Validated senders and client status",[131,135,139,143,147],[132,133,134],"client-a-example.com","p=none, quarantine at W+4","Mailbox and newsletter validated; invoicing to confirm",[136,137,138],"client-b-example.com","p=quarantine, reject at W+8","Four senders aligned; no legitimate failure in reports",[140,141,142],"client-c-example.com","p=reject, weekly review","CRM added by the client, DKIM to publish",[144,145,146],"client-d-example.com","p=quarantine, no reject planned","Addresses used on lists; choice recorded",[148,149,150],"client-e-example.com","p=none, no stage planned","Client not answering; follow-up to schedule",{"type":34,"title":152,"body":153},"Troubleshooting: five common failures across a portfolio","On a portfolio, the same five incidents keep coming back. Here they are with their cause and the action that clears them.",{"type":41,"title":155,"items":156},"Symptoms and remedies",[157,158,159,160,161],"**No report arrives** — the `rua` address is on a different domain from the client's and the `_report._dmarc` authorisation record is missing: publish it, otherwise the receiver ignores the address.","**A tool passes SPF and DKIM but fails DMARC** — its Return-Path and `d=` are the provider's: publish the DKIM CNAMEs in the client's name to align DKIM.","**SPF in permerror** — more than 10 DNS lookups (RFC 7208): remove the `include:` entries of abandoned tools or move the tool to a dedicated sending subdomain.","**A new tool is refused after reject** — the client adopted it without telling you: go back to quarantine while you align the tool, rather than loosening alignment.","**The client does not answer** — stay on p=none or quarantine, record the follow-up and its date in the tracking table; a reject published without an inventory puts your responsibility at stake.",{"type":34,"title":163,"body":164},"The official documentation","RFC 9989, DMARCbis (tags, subdomains, interoperability): https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc9989.html\n\nRFC 9990, DMARC aggregate reporting (external destinations): https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc9990.html\n\nRFC 7208, SPF (10 DNS lookup limit): https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc7208.html\n\nRFC 8617, ARC: https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc8617.html\n\nGmail bulk sender requirements: https:\u002F\u002Fsupport.google.com\u002Fa\u002Fanswer\u002F81126\n\nYahoo sender best practices: https:\u002F\u002Fsenders.yahooinc.com\u002Fbest-practices\u002F\n\nOutlook requirements for high-volume senders: https:\u002F\u002Ftechcommunity.microsoft.com\u002Fblog\u002Fmicrosoftdefenderforoffice365blog\u002Fstrengthening-email-ecosystem-outlook%E2%80%99s-new-requirements-for-high%E2%80%90volume-senders\u002F4399730","Your clients' domains in one place","Your clients, their domains and their hosting in one space: you manage the relationship, we run the infrastructure","Discover the agency offer","\u002Fsolutions\u002Fagences",[170,187,203],{"id":171,"slug":172,"slugs":173,"title":177,"excerpt":178,"readTime":179,"views":180,"isPinned":19,"publishedAt":181,"updatedAt":182,"category":183,"categories":184,"featuredImage":28,"bgImage":29,"posterImage":186,"relatedSolution":28},345,"dmarc-p-quarantine-email-deliverability",{"fr":174,"en":172,"ar":175,"es":176},"dmarc-p-quarantine-email-delivrabilite","dmarc-p-quarantine-email-deliverability-ar","dmarc-p-quarantine-entregabilidad-email","DMARC p=quarantine: stop sending in monitor-only mode","In 2026, Google and Microsoft throttle senders of more than 100 emails\u002Fday stuck on DMARC p=none. SPF, DKIM, DMARC and List-Unsubscribe one-click checklist.",9,1,"2026-09-10T00:00:00+00:00","2026-09-10T13:10:45+00:00",{"id":17,"name":23,"slug":24,"color":25,"icon":24},[185],{"id":17,"name":23,"slug":24,"color":25,"icon":24},"\u002Fblog\u002Fcovers\u002Fdmarc-p-quarantine-email-delivrabilite-poster.svg",{"id":188,"slug":189,"slugs":190,"title":194,"excerpt":195,"readTime":196,"views":18,"isPinned":19,"publishedAt":197,"updatedAt":198,"category":199,"categories":200,"featuredImage":28,"bgImage":29,"posterImage":202,"relatedSolution":28},463,"dmarcbis-rfc-9989-email-changes-2026",{"fr":191,"en":189,"ar":192,"es":193},"dmarcbis-rfc-9989-ce-qui-change-email-2026","dmarcbis-rfc-9989-تغييرات-البريد-الإلكتروني-2026","dmarcbis-rfc-9989-cambios-correo-electronico-2026","DMARCbis RFC 9989: what changes for your mail server","RFC 9989, 9990 and 9991 replaced RFC 7489 in May 2026. Learn the three concrete changes — np tag, removal of pct, Tree Walk DNS — and how to update your DNS records and",8,"2026-10-17T00:00:00+00:00","2026-10-18T21:57:56+00:00",{"id":17,"name":23,"slug":24,"color":25,"icon":24},[201],{"id":17,"name":23,"slug":24,"color":25,"icon":24},"\u002Fblog\u002Fcovers\u002Fdmarcbis-rfc-9989-ce-qui-change-email-2026-poster.svg",{"id":204,"slug":205,"slugs":206,"title":210,"excerpt":211,"readTime":212,"views":18,"isPinned":19,"publishedAt":213,"updatedAt":214,"category":215,"categories":216,"featuredImage":28,"bgImage":29,"posterImage":218,"relatedSolution":28},199,"spf-dkim-dmarc-passing-the-5000-email-threshold",{"fr":207,"en":205,"ar":208,"es":209},"spf-dkim-dmarc-delivrabilite-emails-pro","spf-وdkim-وdmarc-تجاوز-عتبة-5000-رسالة","spf-dkim-dmarc-superar-el-umbral-de-5000-correos","SPF, DKIM, DMARC: passing the 5,000-email threshold","Gmail and Outlook reject senders without aligned SPF, DKIM and DMARC with an SMTP 550 error. Here is how to configure all three records.",4,"2026-08-01T00:00:00+00:00","2026-09-07T11:26:10+00:00",{"id":17,"name":23,"slug":24,"color":25,"icon":24},[217],{"id":17,"name":23,"slug":24,"color":25,"icon":24},"\u002Fblog\u002Fcovers\u002Fspf-dkim-dmarc-delivrabilite-emails-pro-poster.svg",1793289218354]