Key points at a glance
- p=reject is the goal: only then are forged emails sent in your name rejected.
- The path runs through observing, fixing and gradually tightening the policy – usually over several weeks.
- Reviewing the reports at every stage catches problems before genuine emails get rejected.
Step 1: observe with p=none
Set up a DMARC record with p=none and a reporting address (rua). Nothing is blocked, but you find out who sends in your name. Plan for at least two to four weeks so that infrequent senders, such as monthly invoices, also become visible.
- p=noneObserve for two to four weeks
- Fix sendersSPF and DKIM for every service
- p=quarantineFirst part of the emails, then all
- p=rejectForgeries are rejected
StartFull protection
Step 2: identify and fix all senders
Go through the reports and assign each source: your own mail server, newsletter tool, CRM, ticketing system, accounting software. Set up SPF and DKIM with your domain for every legitimate service. Unknown sources are often forgeries – or forgotten services.
Step 3: quarantine step by step
Once almost all legitimate emails pass DMARC, switch to p=quarantine, at first only for part of the emails (pct=25), then for all of them. After each stage, check the reports for at least a week.
Don’t rush it
Jumping straight from p=none to p=reject risks rejecting genuine invoices or newsletters. Every level needs clean reports.
Free domain check
Is your company address protected?
Enter your domain or your email address. You see the result right here, with a traffic light and a grade from A to F.
You opened a link to a result. The check only starts when you click, always with the current state.
Privacy: if you enter an email address, we transmit only the domain; the part before the @ never leaves your browser. We use the domain only for this check of public DNS records and do not store it in plain text; we do not store the result. We store your IP address only as a checksum and for at most one day to curb abuse.
The quick check is based on public DNS data at the time of the query and does not replace a full review; no warranty.
Keep an eye on it continuously instead of checking once:
Book a free initial callMonitor your domain – 14 days freePrefer some help? Ask us to set it up- No commitment
- No credit card
- Ends on its own after 14 days
No-obligation request by email · price on request
What happens next
- Your email program opens a prepared request with your domain. Add your name and send it.
- We get back to you and discuss with you or your IT partner which records (SPF, DKIM, DMARC) are needed and what the setup costs.
- The setup needs access to the DNS management of your domain. We agree the handover with you – please never send us passwords by email.
- If you wish, DomainRadar then monitors your domain continuously and alerts you when something changes.
No email program opens? Write to us with your domain at info@domainradar.ch.
Good to know: this protection stops anyone forging exactly your domain. Against look-alike addresses, always confirm payment changes by phone.
All checks
Quick check based on public DNS records. Continuous monitoring also checks certificates, blocklists and your DMARC reports.
Your result as a PDF
As a report to keep or to forward to your IT.
Free and without an account: you confirm your address by email and can unsubscribe at any time.
Step 4: p=reject
If the reports stay clean, switch to p=reject. Forged emails are now rejected. Remember subdomains (sp=) and domains that send no email at all: these too should have p=reject, together with an SPF record of “v=spf1 -all”.
Step 5: stay on top of it
New services, a change of mail provider or an expired DKIM key can disrupt a clean setup again at any time. So keep evaluating the reports continuously even after the switch.
Every time you add a new service
When you introduce a new tool that sends emails in your name, set up SPF and DKIM for it before it goes live.
How DomainRadar helps
DomainRadar’s p=reject wizard only suggests the next level once enough data is available: at least 14 days on p=none or 7 days on one level, reports from multiple recipients, and a high pass rate with hardly any unknown sources. This way you always know whether the next step is safe.
After every level change, the regression watch checks for about 14 days whether your legitimate services see more rejections than before. If they clearly do, you get an alert with the previous DMARC record as a way back and a gentler alternative: align the service with DKIM first. You change your DNS yourself; DomainRadar only recommends.
The domain check stays free. Afterwards you test DomainRadar with all features for 14 days – no credit card, the trial ends on its own.