You are a few days into a MonitorDMARC trial. Reports are arriving. The dashboard is full of IP addresses and pass rates, and a small voice is asking the obvious question: when do I actually turn this thing on?
The “this thing” is enforcement, meaning p=quarantine and eventually p=reject. It is the whole point of DMARC, because a record sitting at p=none watches spoofing happen and does nothing about it. It is also the step that scares people, since a wrong move can send your own invoices into the void.
This post is a routine for getting there using alerts as the safety net, so you are not babysitting a dashboard. If you want the general theory first, The DMARC Enforcement Journey covers it. This is the hands-on, trial-week version.
Start where Google tells you to start
Google’s own guidance for Workspace admins is to begin with p=none while you review reports, then move to quarantine or reject. It also says to always include a rua= address, preferably a reporting service rather than your personal inbox, because reports arrive in volume. If you have followed our setup guide, you already have this:
_dmarc.example.com. IN TXT "v=DMARC1; p=none; rua=mailto:[email protected]"Leave it there while data accumulates. A few days of reports will show your main senders, and a couple of weeks will show the stragglers: the monthly invoicing run, the quarterly survey tool, the website form that only fires when someone fills it out.
Step 1: Make a list of failing senders
Open the failing sources in your dashboard and sort them into three piles.
Legitimate and failing. Your CRM, your helpdesk, your marketing platform. These are the ones to fix. The usual cause is that SPF or DKIM passes, but not in a way that aligns with your From domain. How to Read DMARC Reports explains alignment, and Your First DMARC Report walks through what to check first.
Legitimate but forgotten. Something marketing set up two years ago. You will need to ask around.
Not yours. IPs you have never heard of sending as your domain. These are what p=reject is for. Leave them alone, and do not add them to SPF.
For each legitimate sender, fix it at the source: enable custom-domain DKIM signing in the service, or add its SPF include if it sends with your envelope domain. Then wait a day or two and look at the report again. The pass rate for that sender should climb.
Step 2: Turn on the alerts and stop checking daily
Monitoring is only useful if you do not have to remember to do it. MonitorDMARC watches your SPF, DKIM, DMARC and BIMI records and emails you when they change, and it shows which senders are failing so new problems stand out. Alerts are part of every plan, including the trial.
That matters during enforcement for two reasons. A DNS change is the most common way a working setup breaks: someone edits the SPF record to add a vendor and accidentally pushes it past the 10-lookup limit, and every message from that domain starts failing. RFC 7208 is blunt about it: exceed 10 DNS-querying terms and the result is a permerror. An alert on that record change gets you looking in minutes, not after the complaints start.
The second reason is that a new failing source appearing after you enforce is exactly the signal you want to see quickly.
Step 3: Move to quarantine
Once your legitimate senders are passing consistently, change the policy:
_dmarc.example.com. IN TXT "v=DMARC1; p=quarantine; rua=mailto:[email protected]"With quarantine, receivers treat failing mail as suspicious, which usually means the spam folder. That is a much softer landing than rejection, and it gives you a window to find anything you missed. Google also describes using the optional pct tag to apply the policy to a share of your mail first, but note that the DMARC specification was revised in 2026 and pct was dropped from the new RFC. Check how your receivers treat it before relying on it.
Watch the reports for a couple of weeks. If a legitimate sender shows up failing, you will know quickly, and the cost is a spam-foldered message instead of a lost one.
Step 4: Move to reject
When a few weeks at quarantine look clean:
_dmarc.example.com. IN TXT "v=DMARC1; p=reject; rua=mailto:[email protected]"After this, receivers are asked to reject failing mail, preferably during the SMTP conversation. Spoofed mail using your domain stops arriving. Keep the alerts on. The next thing that breaks will be a new vendor someone signs up for without telling you, and the alert is how you will hear about it.
If you also want a logo in the inbox, note that Google says BIMI requires p to be quarantine or reject, so this work pays off twice.
A realistic timeline
In a trial of 14 days you will not reach p=reject on a busy domain. You can reach the point where you know your senders, have fixed the obvious failures, and have a plan with dates. That is a good outcome. Enforcement is a few weeks of calm, unglamorous work, and most of the value of a tool is that it makes those weeks boring.
Pick a plan before the trial ends
When the trial ends, your data stays useful only if you keep the service running. Compare plans on the pricing page. Starter ($19.99/month) covers 2 domains with 1 year of history, which suits most single-domain shops, and Professional ($49.99/month) covers 5 domains and 2 years if you also have brand or parked domains to protect. The trial includes 2 domains and does not charge your card automatically.