# DMARC p=reject Rollout Worksheet

*A free VigilDog resource — vigildog.com. Reach enforcement without blocking your own email.*

`p=reject` stops spoofing of your domain — but only enforce it after every legitimate sender is
aligned, or you will block your own newsletters and invoices. Work the stages in order.

---

## Step 1 — Inventory your senders

List every system that sends email as your domain. Fill the table (mark ✅/❌):

| Sending source | Example | SPF aligned? | DKIM aligned? | Action needed |
|---|---|---|---|---|
| Primary mailbox | Google Workspace / M365 | | | |
| Marketing / ESP | Mailchimp, Klaviyo… | | | |
| Transactional | SendGrid, Postmark… | | | |
| Help desk | Zendesk, Intercom… | | | |
| CRM | HubSpot, Salesforce… | | | |
| Billing / invoicing | Stripe, QuickBooks… | | | |
| Other | | | | |

## Step 2 — Observe with p=none

- [ ] Publish `v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com` at `_dmarc`.
- [ ] Collect aggregate (RUA) reports for **2+ weeks**.
- [ ] Confirm every row in Step 1 appears in the reports (no surprise senders).

## Step 3 — Align every legitimate sender

For each source, make it pass via **aligned** SPF and/or DKIM:

- [ ] Enable **DKIM signing with your domain** in the platform.
- [ ] Set a **custom return-path / envelope domain** so SPF aligns.
- [ ] Re-check reports until each legitimate source passes DMARC alignment.

## Step 4 — Stage the policy

- [ ] `p=quarantine` — optionally with `pct=25` → `50` → `100` to ramp.
- [ ] Watch for a week that **nothing legitimate** is quarantined.
- [ ] `p=reject` — enforce.
- [ ] Keep `rua=` reporting **permanently** on.

**Gate to advance a stage:** 100% of your identified legitimate sources pass aligned SPF or DKIM,
and reports show no legitimate mail failing.

## Step 5 — Keep it enforced

After reject, the risk is a **new** tool that starts sending unaligned and gets silently rejected.

- [ ] Review DMARC reports monthly for new sources.
- [ ] Monitor the DMARC record itself for unexpected changes.

---

## Monitor it

**[VigilDog](https://vigildog.com/monitoring)** watches your SPF, DKIM and DMARC records so a new
unaligned sender — or an accidental record change — is a heads-up, not lost mail. Full guide:
https://vigildog.com/guides/dmarc-p-reject-rollout · Start free: **https://vigildog.com/signup**