Publishing p=none changes nothing about delivery and starts the reports arriving within a day. Those aggregate XML files list every IP sending mail as your domain, which is the inventory the whole exercise depends on.
Two to four weeks of reading is typical for an organization of any size. Almost everyone finds something unexpected: an invoicing tool, a contractor's mail merge, a CRM nobody documented. Each one needs authenticating before enforcement.
Move to quarantine at pct=10 and watch. A tenth of failing mail now goes to spam folders, which is recoverable if you missed something, and the reports will show you what you missed.
Raise the percentage in steps to 100, then switch to reject. Mailing lists are the usual casualty at this point, because a list that rewrites headers breaks the DKIM signature while SPF was already broken by the relay.
Handle that by sending list traffic from a subdomain with a softer policy, and set the sp tag explicitly rather than letting subdomains inherit a policy you did not intend for them.
Reading one row of an aggregate report
Say your first report includes this row: source IP 198.51.100.24, count 412, DKIM fail, SPF pass. It looks half fine. Then you read the detail. SPF passed for a domain like bounce.invoicetool.example, which isn't yours.
That row is your invoicing tool. It sent 412 messages with your address in the From line, but it sent them under its own bounce domain and without your signature. SPF passed for the tool's domain, but that domain doesn't match yours, so it doesn't count toward DMARC. At p=none nothing happens to those messages. Once you move to p=reject, all 412 invoices a day would be refused.
The fix lives in the tool's settings. Most offer a custom bounce domain or a DKIM key for your domain, and some offer both. Set those up and wait for the next report. The row should now show a pass that lines up with your domain.
The record at each stage, and the domains you don't send from
It helps to see the actual text. Stage one is v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. For stage two, change the policy and add a percentage: p=quarantine; pct=10. Raise that number over a few weeks. Stage three is p=reject, and if your subdomains need gentler handling, add sp=quarantine beside it.
Use a mailbox for rua that can take volume. Large providers send a report every day, and a busy domain collects hundreds of files a month. A person's own inbox is the wrong home for them.
Domains you own but never send from follow a different rule. The spare .net, the old brand name and the misspelling you bought for protection need no monitoring period, because no real mail exists to break. Give each one p=reject today, along with an SPF record of v=spf1 -all. Spoofers like parked domains because nobody watches them.
Related questions
Is p=none enough?
It satisfies the Google and Yahoo bulk-sender requirement and offers no protection. Anyone can still spoof your domain successfully.
How long until I can enforce?
Two to four weeks of reading reports for most organizations, longer where many departments send independently.
What is the pct tag for?
It applies the policy to that percentage of failing mail, so you can move into enforcement gradually rather than all at once.
What breaks at p=reject?
Mailing lists and some forwarding, because header rewriting breaks DKIM after SPF was already broken by the relay.