How long does a DMARC change take to work?

A DMARC change takes effect once cached copies of the old record expire, which is governed by the record's TTL (time to live) and can be anywhere from minutes to hours. The first reports usually arrive within a day or two. A safe move from monitoring to enforcement takes longer, because it depends on what the reports show.

Why it matters

Expecting instant results leads to two opposite mistakes: panicking when nothing seems to change, and tightening the policy again before the previous step has been seen by every receiver. Knowing the three clocks involved, DNS, receivers and your own review, lets you pace each change.

How to do it

Check the TTL. A TTL is a number of seconds that tells resolvers how long they may reuse an answer. Run dig TXT _dmarc.example.com and read the number shown in the answer line. A TTL of 3600 means caches can hold the old value for up to an hour after you change it.
Lower the TTL before a planned change if you want faster updates. Do it a little ahead of time, because the old, longer TTL still applies to answers already cached.
After saving a change, look up the record from your own machine and from another network or resolver to see whether both show the new value.
Wait for reports. Receivers batch aggregate reports, and the default interval in RFC 7489 is 86400 seconds, one day. Reports for the new policy start appearing after that, and each one covers a period of mail.
Keep each step in place long enough to see a full cycle of your normal mail, including weekly, monthly and campaign senders. For many organisations that means several weeks per stage, though the right length is a judgement based on your reports, not a fixed rule.
Only then move to the next step, as described in Set Up DMARC: From p=none to Quarantine and Reject.

Common mistakes

Changing the policy again after an hour because the reports look the same. Reports lag behind DNS.
Testing from one machine that has the old answer cached.
Lowering the TTL at the moment of the change rather than beforehand.
Moving to enforcement after a single day of data.
Forgetting that some receivers cache longer than the TTL suggests.

Frequently asked questions

Does my mail get protected immediately?

Receivers begin applying the new record as soon as they fetch it. Those with cached copies apply the old one until the cache expires.

When will I get my first DMARC report?

Often within about a day or two, but timing is up to each receiver. Some send nothing until they see enough mail from your domain.

How long should I stay on p=none?

There is no set length. Stay until your reports show that all legitimate senders pass. See DMARC p=none vs p=quarantine vs p=reject.

Want a snapshot of your domain's records? Try the free website sample.