Move DMARC from monitoring to quarantine, then reject on Cloudflare

Why it matters

p=none only monitors, so receivers still deliver spoofed mail that claims to come from your domain. Enforcing the policy is what actually blocks it, but it has to be done in steps so legitimate mail is not caught.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. In the Cloudflare dashboard open DNS > Records, find the TXT record named _dmarc and choose Edit. Change only the p= value, leaving rua and any other tags as they are, then save.
2. Do the stages in order and only after the reports are clean: p=quarantine first, watched for one to two weeks, then p=reject. To roll back, set p=none. Do not use pct; RFC 9989 removed it.
3. Cloudflare DMARC Management (Email > DMARC Management) can summarise the reports to help you decide.

Type:     TXT
Name:     _dmarc.example.com
Content:  v=DMARC1; p=quarantine; rua=mailto:[email protected]

# Stage 3, after clean reports, Content:
# v=DMARC1; p=reject; rua=mailto:[email protected]

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the DMARC policy check
• Publish a DMARC record, starting in monitoring mode
• Keep only one DMARC record
• Fix the invalid DMARC record
• Move DMARC from quarantine to reject
• Remove the pct tag from the DMARC record
• Remove the t=y test flag from the DMARC record
• Make the DMARC subdomain policy match the main policy
• Add a report address to the DMARC record
• Remove or fix the invalid tags in the DMARC record