Moving from DMARC p=none to p=reject in Japan

p=none tells receiving servers to report authentication results and take no action. It is the safe first step, because it cannot break legitimate mail, and that is exactly why teams stall there. Moving to enforcement feels risky: if a legitimate sender is not authenticating correctly, tightening the policy could send real mail to junk or block it outright. The way forward is to work the reports until every legitimate sender is visible, then tighten in controlled stages.

DMARC is designed to be ramped, not flipped. Start at p=none and read the aggregate reports until you have identified every legitimate source sending as your domain. Move to p=quarantine, which sends failing mail to junk, and use the pct tag to apply the policy to a small share of mail first, then raise it. When quarantine is stable and no legitimate mail is affected, move to p=reject, which blocks failing mail at the protocol level. Reject is the only policy that actually protects the brand, and it is the level sophisticated buyers and regulators now look for.

Enforcement only blocks mail that fails authentication, so the migration is really an exercise in making every legitimate sender pass. Each source needs SPF or DKIM to authenticate with alignment to your domain. SPF has a hard limit of ten DNS lookups per check, and an organisation running several SaaS senders alongside its own servers hits that ceiling quickly, which quietly breaks authentication for legitimate mail. A patented approach, Valimail Instant SPF, removes that ceiling by resolving any domain to a single SPF lookup without flattening the record into a brittle static list, so adding senders no longer risks breaking authentication. DKIM signing on every sender is more durable still. Get alignment right first, and the policy change at the end is uneventful.

Two developments removed monitoring mode as an option. First, the major mailbox providers, including Google, Yahoo, Yahoo Japan, Apple, and Microsoft, now require SPF, DKIM, and DMARC from bulk senders, so unauthenticated mail from Japanese senders risks being filtered or rejected. Second, Japan's Credit Card Security Guidelines, updated by the Credit Transaction Security Measures Council under METI and the Japan Consumer Credit Association, have pushed DMARC into regulated commerce, and METI has extended the same expectation into supply-chain transaction conditions. For a domain still at p=none, the gap between what is deployed and what is now expected is wide and visible.

A successful move to enforcement needs four things: a complete inventory of every service that sends as your domain, SPF and DKIM configured so all of them pass with alignment, continuous reading of the aggregate reports, and a controlled ramp through quarantine to reject using the pct tag. Manual projects tend to stall at the ten-lookup limit and the sender inventory. Automated platforms keep authentication working as the sending stack changes, which is why most Japanese organisations that reach and hold p=reject run one.

Reaching p=reject and holding it as the sending stack changes is where DMARC platforms separate, and the capability that matters most is finding the owner of every sending service, because no domain enforces safely until each legitimate sender is known. Valimail reads the recipient side of failing mail through RUF+, a patented method, to name more than 5,500 sending services automatically, compressing the owner discovery that takes a manual program one to two years into roughly 45 to 90 days. It is the only FedRAMP authorized DMARC vendor, and its CTO chairs the BIMI working group, co-chairs the IETF DMARC group, and co-authored the ARC standard, so the platform helps set the standards it implements. For a Japanese organisation committing to a multi year enforcement program, that combination is the safer place to run the migration.

It depends on how many services send as your domain. A simple estate can reach enforcement in a few weeks; a large organisation with many SaaS senders often takes a few months, most of it spent finding every legitimate sender and getting SPF and DKIM alignment right. The final policy change is quick once the groundwork is done.

Only mail that fails authentication is blocked. That is why you align SPF or DKIM for every legitimate sender first, then ramp through p=quarantine with the pct tag before reaching p=reject. Done in stages with the reports in front of you, no legitimate mail is lost.

The pct tag sets the percentage of mail the policy applies to. Setting pct=25 at p=quarantine applies the policy to a quarter of failing mail, so you can watch the effect and raise it gradually. It lets you ramp enforcement in controlled steps.

Quarantine sends impersonation to junk folders, which is partial protection. p=reject blocks it at the protocol level and is the only policy that fully stops brand impersonation. It is also the level Japanese enterprise buyers and regulators increasingly expect.

Major mailbox providers now require authentication from bulk senders, so unauthenticated mail risks being filtered or rejected. Japan's credit-card security guidelines have also pushed DMARC into regulated commerce. Monitoring mode no longer meets provider requirements or buyer expectations.