Enforcement is a sequence of stages with an explicit test for leaving each one. The sequence matters less than the tests: a plan that says "monitor for four weeks, then quarantine" is a calendar, not a criterion, and calendars do not know whether your payroll system aligns yet.
The stages
| Stage | Record | Leave when |
|---|---|---|
| 1. Monitor | p=none; rua=... | You can name every source above a volume you care about, and the aligned share is stable rather than still climbing as you discover senders. |
| 2. Subdomains first | p=none; sp=reject | Subdomain reports show no legitimate mail being affected. Usually a week; often immediate. |
| 3. Quarantine | p=quarantine | No new failing legitimate sources appear, and nobody reports missing mail. Two to four weeks. |
| 4. Reject | p=reject | The end state. Keep reading reports. |
Why subdomains come first
Stage 2 is the highest-value, lowest-risk step available and it is routinely skipped.
Most organisations send from a handful of names and have dozens of subdomains that send nothing at all. Those subdomains are freely spoofable and nothing legitimate is at risk, so sp=reject costs nothing and closes a real gap — while the main domain is still at p=none and you are still discovering senders.
v=DMARC1; p=none; sp=reject; rua=mailto:dmarc@example.com
Before you do it, check the reports for subdomain traffic. If a subdomain is sending legitimately you will see it, and that subdomain needs its own record or its own inventory entry first.
Go and no-go
Move on when all of these are true:
- Every source above your volume threshold is identified and classified.
- Every source in the "yours, not aligned" group is either fixed or deliberately accepted as breakage you have signed off.
- The aligned percentage has been stable for at least two reporting periods. Still rising means you are still discovering senders.
- You have read reports from more than one receiver.
Do not move on when:
- A significant sender is unidentified. Not a small one — significant. Waiting for certainty about every row is how projects stall for a year.
- You changed something in the last few days and have not seen its reports yet.
- It is the week before a peak period. Nobody wants to diagnose a mail problem during month-end billing.
Reports going quiet is a signal, not a success
If report volume drops sharply, the likeliest explanations are that your rua destination stopped accepting them, or that the destination is at a different domain and its authorisation record was removed or was never there. Reports arriving is itself a health check — treat a sudden silence as an incident, not as an improvement.
Rollback
Have the previous record written down before you change anything, and know your TTL. If legitimate mail starts failing, publishing the weaker policy takes seconds and takes effect as fast as the TTL allows — which is why a long TTL on a _dmarc record is a bad idea during a rollout. Set it low while you are moving, and raise it when you have settled.
Rolling back is not a failure. It means the monitoring found something real, which is what it was for.
It does not stop at reject
Senders change. Marketing adopts a platform, a subsidiary is acquired, a vendor restructures its infrastructure. At p=reject a new unaligned sender does not degrade quietly — its mail bounces. Reading reports has to continue, and the ongoing work is smaller than the rollout but it is not zero.