Why reject exists
DMARC without reject is mostly visibility. You learn who sends as your domain. Spoofers still land in inboxes when receivers treat p=none as a suggestion.
Reject is the policy that makes the DNS record a control. Receivers that honour it will refuse mail that fails authentication and alignment under your domain. That is the outcome worth the work.
It is also the week your CRM, ticket system, marketing platform, and that one legacy scanner start failing delivery if they were never aligned.
The senders you forgot
Aggregate reports are unkind in a useful way. They show ESP platforms finance never mentioned, a subsidiary’s newsletter tool, a printer that emails scans, a contractor’s outreach sequence still signed with your domain.
None of these feel urgent until reject turns “delivered” into “rejected”. Inventory from memory will miss them. Inventory from two to four weeks of reports will not.
For each source, decide: fix alignment, move it to a subdomain with its own policy, or shut it down. “We’ll deal with it later” is how you roll back reject under pressure.
Alignment, not just authentication
People confuse SPF or DKIM passing with DMARC passing. Mail can authenticate and still fail DMARC when the authenticated identifier does not align with the header From domain.
Those rows are the dangerous ones before reject. They look healthy in a naive ESP dashboard and fall over when policy tightens. Fix alignment first: proper DKIM on the From domain, or SPF that matches how the message is actually sent, within the limits SPF can handle.
Forwarding and mailing lists complicate life. Know which flows you must keep working and test them before the flip.
A sane cutover
Stay on monitor until the report noise is understood. Move to quarantine when you want receivers to start treating failures roughly without the full blast radius. Move to reject when the remaining failures are acceptable losses or already fixed.
Tell the people who send mail. A DNS change without an internal note produces panic tickets that look like an outage.
Keep reading reports after reject. New vendors appear every quarter. DMARC is not a set-and-forget badge; it is an operating habit.