DMARC has been at p=none for months, when and how to move to quarantine and reject?

p=none is monitor only, no protection. p=quarantine says 'receiver, drop in spam', p=reject says 'reject'. Move stepwise using pct= as a handbrake so you can roll back fast.

Try this first

1. 1Prerequisite: read at least 2 weeks of DMARC reports and confirm 95+ percent of legitimate mail is SPF or DKIM aligned.
2. 2Step 1: p=quarantine; pct=10. Only 10 percent of failing mail goes to spam, the rest stays normal. Read reports for a week.
3. 3Step 2: pct=25, 50, 100 over two to three weeks. At each step verify no legitimate source ends up in spam.
4. 4Step 3: p=reject; pct=100 once you are 100 percent comfortable at quarantine. From now on failing mail is rejected.
5. 5Keep the rua mailbox alive, because vendor changes or new SaaS tools can break alignment without warning.

None of the above fits?

Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.