The enforcement journey: none, quarantine, reject

DMARC has three policy actions: none, quarantine and reject. Moving through them in order, and only when the evidence says it is safe, is how you go from simply watching your email to actively blocking spoofed messages. DMARCER turns that journey into a guided, per-domain workflow, so you can move forward with confidence rather than guesswork.

What the enforcement journey does

For every validated domain, DMARCER works out which enforcement stage your live DMARC record is at, reads your recent aggregate (RUA) reports, and tells you whether it is safe to advance to the next stage. It also builds the exact DMARC record you would publish to make that move, keeping all your existing tags (such as rua= and ruf=), and it can publish it for you if the domain is linked to a DNS integration.

You can work on one domain at a time from its DMARC panel, or see your whole estate at once. The top-level Enforcement page lists every validated domain, sorted by what needs attention first: Ready to advance, then Almost ready, then Not yet, then End state. Each row also shows small chips for the MTA-STS and TLS-RPT layers, so you can see how complete a domain's overall protection is at a glance.

The stages on the ladder

DMARCER treats the journey as a ladder rather than three blunt steps. The reject and quarantine actions can each be applied to a percentage of your mail (using the DMARC pct= tag), so you can ramp up gradually instead of switching everything on at once.

• Not configured: no DMARC record published. Nothing is being assessed or reported yet.
• Monitoring (p=none): nothing is blocked; you are only collecting reports. Publishing this is always safe.
• Quarantine ramp: Quarantine 10%, 25%, 50%, then Full quarantine (100%). Failing mail is sent to the spam or junk folder, starting with a small slice and increasing.
• Reject ramp: Reject 10%, 25%, 50%, then Full reject (enforced) at 100%. Failing mail is refused outright. Full reject is complete protection.

Each partial step means only that percentage of failing messages is acted on; the rest still get through. That is deliberate: it lets you watch for any knock-on effect on a fraction of your traffic before committing the whole flow.

Step by step: advancing a domain

1. Open Domain Management, click the DMARC cell for the domain, and stay on the Enforcement journey tab (it opens by default).
2. Read the header card: it shows the current Stage chip, a readiness badge (Ready to advance, Almost ready, Not yet, or End state), a plain-language explanation, and the window statistics (for example, last 7 days, total messages, compliant messages and the compliance percentage).
3. Look at the Next step card. It shows the target stage, the Proposed record (the full TXT value you would publish), and an impact Projection, for example how many currently-failing messages advancing now would quarantine or reject.
4. Work through the Top unaligned senders table first if anything is failing. This is your to-do list: each row lists the source IP, ISP, message count, pass percentage and the reason it is failing (for example, no alignment, or SPF passes but is not aligned). Fix or authorise these senders to push your compliance percentage up.
5. When the badge reads Ready to advance (or Almost ready), publish the proposed record. If the domain is linked to a DNS integration, the button reads Automatically update record via your provider; otherwise use Copy new record and publish it at _dmarc.yourdomain yourself.
6. For the automatic path, a Publish DMARC record confirmation appears showing a before and after comparison and the merged record. Your existing rua= and ruf= addresses are kept; only the highlighted rows change. Click Apply changes to publish.
7. Repeat up the ladder. Each successful publish is saved on the History tab, along with the source and who made the change, so you always have a clear record of what happened.

How readiness is decided

Readiness is not a guess. DMARCER measures your compliance (the share of mail that aligns and passes) over a recent window and compares it against three thresholds for the next stage: a minimum compliance percentage, a minimum number of messages to base the decision on, and the length of the window in days.

• Ready to advance: compliance is at or above the threshold for the next stage. Safe to move up.
• Almost ready: compliance is just under the threshold (within a few points). Tighten up the top unaligned senders and check again.
• Not yet: compliance is below the threshold, or there is not enough mail in the window to judge safely. The explanation tells you which, and how many more messages are needed.
• End state: the domain is already at full reject with no partial percentage, so there is nothing further to advance.

Publishing p=none (Monitoring) is always treated as Ready, because it blocks nothing and simply turns on reporting. The thresholds themselves come from your enforcement policy in Company Settings. New accounts start with the built-in Aggressive defaults (short windows and modest message minimums, designed to reach reject in weeks). You can switch to Balanced or Conservative, or set your own per-stage minimums, and every domain's journey will reflect that choice.

Common pitfalls

• Jumping straight to reject. If a legitimate sender is not authenticated yet, reject will block their mail. The ladder and readiness checks exist to catch those senders at p=none and during the quarantine ramp, before any real mail is refused.
• Advancing while the badge says Not yet. The Advance button stays disabled until readiness allows it. If it is greyed out, read the explanation: usually it is low compliance or too little traffic in the window to decide safely.
• Forgetting subdomains. The manual editor's Protect subdomains (sp) option, on by default, sets sp= to match your main policy so subdomains get the same enforcement. An existing record with sp= weaker than p= will trigger a compliance alert.
• Reading partial percentages as full protection. Quarantine 50% or Reject 50% only acts on half of your failing mail. The domain is not fully enforced until it reaches Full reject (enforced) at 100%.
• Stopping at DMARC. Full reject protects the From address, but MTA-STS and TLS-RPT are the natural next layers. The journey shows advice cards for these once DMARC is enforcing, and the Enforcement page chips show which layers are still outstanding.
• Turning on forensic (RUF) reporting without thinking it through. RUF samples include headers and message snippets that can carry personal data. Only enable it if your privacy posture allows, and check with your DPO if you are unsure.