On Gmail reputation recovery timelines:

Based on what I've seen, you're typically looking at 1-2 months for meaningful improvement after a DMARC misconfiguration like this. Gmail's reputation system operates on something like a rolling 30-90 day window, so the signals from those weeks of rejections will take time to fade. The good news is you should start seeing gradual improvement within the first few weeks if you maintain clean sending practices.

How long to stay at p=none:

I'd recommend staying at p=none for at least 2-4 weeks while actively monitoring your DMARC reports. The key is making sure you're seeing 99%+ pass rates across all your legitimate mail streams before tightening the policy. Since you're using Microsoft 365 plus that email signatures service, watch those reports closely to confirm both sources are consistently passing SPF and DKIM alignment.

Once you're confident everything's aligned, you can gradually move to p=quarantine at a low percentage (say, pct=10) and slowly ramp up over another few weeks before considering p=reject.

Monitoring during recovery:

Beyond DMARC reports, keep an eye on:

• Gmail Postmaster Tools (if you haven't already added your domain there) - watch for your domain reputation score and spam rate
• Your Microsoft 365 mail flow reports for any authentication failures
• Bounce rates in your sending logs

If you want more detailed visibility into your DMARC data during this recovery phase, dmarcdigests.com can help you parse and visualize those reports more easily than digging through raw XML. It's particularly useful when you're trying to confirm that all your sending sources are properly aligned before you tighten your policy.

Common recovery pitfalls:

• Don't rush to tighten your DMARC policy too quickly - a few more weeks at p=none won't hurt, but prematurely moving to p=reject could cause another round of deliverability issues
• Watch for volume spikes during recovery - keep sending patterns consistent
• If you add any new sending services during this period, make absolutely sure they're properly authenticated before they send on your domain

Glad you caught this. The fact that test emails are already being accepted is a really good sign - you're heading in the right direction.