How to fix it without breaking anything
• Keep p=none for a few weeks with a rua= address, and read the aggregate reports.
• List every service that sends as you: mailbox, newsletter tool, CRM, invoicing, the shop. Each must pass SPF or DKIM on a domain that matches your From: address. That's alignment.
• Move to p=quarantine, then p=reject once the reports are clean.
• If rua= points to another domain, that domain has to publish an authorization record, or receivers send nothing.
• Ramping up with pct=20? RFC 9989 (May 2026) retired pct. The testing switch is now t=y.