Tighten DMARC: none → quarantine → reject (review from 2026-07-12)

[cdrrazan]

DMARC is live at p=none as of 2026-06-14 (observe phase). Reports flow to dmarc@devis.im → operator inbox.

Do not tighten until aggregate reports are consistently clean (legit forwarded mail passing SPF-via-SRS / DKIM). Earliest review: 2026-07-12 (~4 weeks).

Step 1 — quarantine (after clean reports)

_dmarc.devis.im  TXT  "v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc@devis.im; fo=1"

Optional safer ramp: start pct=25, watch a week, then pct=100.

Step 2 — reject (only once confident at quarantine)

_dmarc.devis.im  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc@devis.im; fo=1"

Before each step

• Aggregate reports show forwarded mail passing DMARC (SPF aligned via SRS or DKIM aligned)
• No legit sources failing
• Google Postmaster DMARC pass-rate healthy

Caveat: plain forwarding breaks SPF; Cloudflare SRS keeps it aligned — verify in the reports, don't assume.
Ref: docs/email-reputation.md.