DMARC reports and the path to p=reject

Mailbox providers send daily aggregate reports listing every server that sent mail as your domain and whether it passed authentication. EmailShift turns them into a readable list of the services sending as you.

Turning reports on

Open the domain page. Under DMARC reports, copy your personal report address.
Add it to the rua= tag of your DMARC record. Keep any existing addresses and separate them with a comma, without a space:
```
 v=DMARC1; p=none; rua=mailto:[email protected],mailto:<your EmailShift address>;
```

The first reports usually arrive within 24 to 48 hours.

Reading the reports

By mailbox provider: who reported, and what share passed DMARC.
Sending sources: services grouped by name (for example Google, SendGrid), with DKIM and SPF alignment. Sources failing DMARC are either services not set up yet, or someone spoofing your domain.
New senders: when a new service starts sending as your domain, EmailShift opens a case. Confirm it as yours, or mark it as not yours.

Moving to p=reject

The section Ready for p=reject? tells you when it is safe to tighten your policy and gives you the exact record for the next step. It moves one stage at a time: p=none → p=quarantine; pct=25 → p=quarantine → p=reject; pct=25 → p=reject; pct=50 → p=reject. Publish the suggested record, wait about a week, and check again.

Something unclear or missing? Tell us.