The Path to DMARC Enforcement

Emails failing DMARC are rejected by receiving servers. Legitimate email with proper authentication is unaffected. Receivers like Gmail and Microsoft will refuse delivery of unauthenticated messages claiming to be from your domain.

Yes. Change your DMARC record back to p=quarantine or p=none. Changes propagate within hours (depending on TTL). This is why gradual rollout with the pct= parameter is recommended.

You can do it manually, but tools make it faster and safer by processing reports, identifying sources, and guiding remediation. Without a tool, you'll need to parse XML reports yourself and manually track all sending sources.

Some legacy systems don't support DKIM. You may need to route through a service that adds DKIM, or accept that sender will fail DMARC. In some cases, you can add the vendor's IPs to your SPF record as a partial workaround.

Key indicators: Pass rate above 98% for 30+ days, all legitimate senders identified and authorized, no pending remediation tasks, and you've verified no legitimate email is being flagged.

The pct= parameter in your DMARC record lets you apply your policy to only a percentage of messages. For example, pct=10 applies your policy to 10% of messages. This allows gradual rollout to catch issues before full enforcement.