Getting to DMARC enforcement without breaking your mail

Why so many domains stop at monitoring

Publishing p=none is safe and takes ten minutes. Publishing p=reject tells the world to throw away mail that fails authentication — and if you have missed a legitimate sender, you have just silently deleted your own invoices, your CRM notifications or your payroll provider's mail.

So people publish p=none, collect reports nobody reads, and stop. The domain stays spoofable, which is the thing DMARC existed to fix.

The step everyone skips

Inventory every sender before you touch the policy. Not the senders you think you have — the ones actually sending. In a typical organisation that list includes several systems nobody in IT remembers procuring: a marketing tool, a survey platform, an ancient on-premises scanner, a payroll system, and at least one thing a department bought on a card.

That list only exists in DMARC aggregate reports. You publish p=none with a reporting address, wait for real traffic, and read what comes back. Two to four weeks of reports beats any amount of asking around.

A staged rollout that does not bite

1. Publish p=none with aggregate reporting to a mailbox you will actually process. Nothing changes for anyone.
2. Collect for two to four weeks. Longer if you have monthly batch processes — the payroll run you miss is the one that hurts.
3. Authenticate the legitimate senders. Add them to SPF where the record has room, and prefer DKIM signing — SPF has a hard limit of ten DNS lookups and large estates hit it constantly.
4. Move to p=quarantine with a percentage. Start at pct=10. Failures go to junk rather than nowhere, so a mistake is recoverable and visible.
5. Raise the percentage as the reports stay clean, then move to p=reject.
6. Keep watching. New senders appear whenever someone buys something. A domain that reached enforcement and stopped being monitored drifts back into breakage.

Three mistakes worth avoiding

• Blowing the SPF lookup limit. Ten DNS lookups, including nested includes. Past that, SPF fails permanently and mail that should pass does not.
• Forgetting subdomains. A policy on the organisational domain does not protect subdomains unless you set sp= — and attackers know this.
• Treating it as a project. It is a state to hold, not a task to close.

Why it is worth finishing

Major mailbox providers now require DMARC for bulk senders. Brand indicators in the inbox need enforcement. Cyber-insurance questionnaires ask. And unauthenticated domains remain one of the cheapest attacks available to anyone targeting your customers or your finance team.