Everything in this track, applied to one estate, with every decision stated. The organisation is fictional; every situation in it is one you will meet.
The estate
northwind.example primary. All company mail. nw-pay.example payments brand. Sends receipts. northwindbank.example acquired six months ago. Unknown. + 34 defensive registrations, believed parked.
Week 1 — the cold audit
| Domain | Found | Tier |
|---|---|---|
northwind.example | p=none, no rua. SPF at 12 lookups — permerror. Two DKIM selectors, one at 1024-bit. | Critical |
nw-pay.example | p=quarantine, rua to a processor. SPF fine. | Medium |
northwindbank.example | p=reject, no rua. Enforcing blind. | High |
| 34 parked | No DMARC, no SPF, no null MX on any of them. | Critical |
The primary domain is at permerror, so SPF is off entirely — and at p=none nothing else is compensating. The acquired domain is the interesting one: the strictest possible policy with no way to see what it rejects.
Week 1 — what ships
All 37 domains: add rua=mailto:dmarc@northwind.example
(and the _report._dmarc authorisation, since
the destination differs from most source
domains)
34 parked: p=none + rua only, for now. NOT the strict
set — two weeks of evidence first, because
"believed parked" is not "parked".
northwindbank: add rua. Policy untouched. It is enforcing,
which is protection; what is missing is
visibility, and that is free to add.Nothing was tightened in week one, and nothing could break. The programme now has evidence accumulating on every domain simultaneously.
Week 3 — the reports arrive
| Finding | Decision |
|---|---|
| 32 parked domains: no mail at all | Strict non-sending set. Generated, applied in an afternoon. |
| 2 parked domains: low-volume mail from a form provider | Not parked. Reclassify. Align or retire the form. |
| northwindbank: 40% of mail failing, from a platform nobody knew about | It has been enforcing and losing that mail for six months. Nobody noticed because nobody was looking. Find the owner. |
| northwind: 14 sending sources, 4 unidentified | Inventory work. Two turn out to be on a card in marketing. |
The acquired domain is the lesson. p=reject looked like the best-configured domain in the estate on the audit, and it was silently destroying two fifths of its own mail.
Weeks 4 to 16 — the primary domain
Week 4 fix the SPF permerror. Remove mx (the MX hosts
do not send), delegate the marketing platform to
mkt.northwind.example. 12 lookups -> 6.
Week 5 rotate the 1024-bit key to 2048 under a new
selector. Revoke the old one after a week.
Weeks 5-10 align the 14 senders. Eleven are configuration.
Two need a support ticket. One — the events
platform — is enterprise-tier only, and the
renewal is in March.
Week 11 the events platform moves to
events.northwind.example with its own p=none.
The exception is contained rather than holding
the apex back.
Week 12 p=quarantine; sp=quarantine; np=reject.
Week 16 four clean weeks. p=reject.The three decisions worth noting
| Decision | Alternative rejected |
|---|---|
| rua everywhere in week one | Starting with the primary domain, and having no evidence for eight weeks |
| Subdomain exception for the events platform | Holding the apex at p=none until a contract renewal in March |
Adding rua to the acquired domain without relaxing p=reject | Reverting it to p=none to "do it properly" — discarding protection to gain information that was free |
Sixteen weeks, and about three weeks of work
Most of the calendar is waiting: for reports, for vendors, for the observation windows between policy steps. That ratio is the thing to communicate at the start, because a programme that looks idle for two months is one somebody will ask about in week six.