DMARC Policy Wizard

Included with every Email Authentication tier, Free included.

1. What This Feature Does

The DMARC Policy Wizard moves a domain from p=none (monitoring) to p=reject (full enforcement) in five stages. For each domain it shows where you are, how long you have been there, how much mail your DMARC reports cover and how much of it passed — and tells you whether it is safe to take the next step. When it is, one click updates your Hosted DMARC record to the next stage.

2. When You Should Use It

• Your domain publishes p=none and you want to reach enforcement without bouncing your own mail on the way.
• You want a clear yes or no, backed by your own report data, before tightening the policy.
• You want BIMI. Your logo only displays once DMARC is at quarantine or reject — see BIMI.

3. When You Should Not Use It

• Domains that never send mail. There is nothing to wait for: set the policy straight to reject under Edit configuration in Hosted DMARC.
• Your DMARC record is published at your DNS host, not by CertaDNS. The wizard changes the record CertaDNS publishes. If receivers are reading a record you maintain yourself, advancing here changes nothing they see. Point _dmarc at CertaDNS first (see Prerequisites).
• Very low mail volume. The wizard needs at least 100 reported messages in the last 7 days before it recommends anything. A domain that sends less than that will stay at Need More Data; change the policy yourself with Edit configuration once your reports show your senders passing.

4. Prerequisites

• The domain added under Email Authentication > Add Domains (or the Setup Wizard). Managed DNS is not required.
• A Hosted DMARC configuration for the domain, with CertaDNS managed reporting on, so aggregate reports reach your dashboard. The Setup Wizard creates one; so does Create configuration in Email Authentication > Hosted Services > Hosted DMARC.
• The record CertaDNS publishes actually being served for your domain. If your DNS is hosted elsewhere, that means the _dmarc CNAME shown for the domain in Email Authentication > Manage Domains is in place and shows Live. On Managed DNS, CertaDNS publishes the record in your zone and you add nothing.
• SPF and DKIM set up for every service that sends as your domain. The wizard measures whether they work; it does not fix them.

5. How It Works (Brief)

Metrics. Once a day, CertaDNS recalculates each domain's figures from the DMARC aggregate reports received in the last 7 days, counting only reports received since the current stage began: the number of messages reported and the percentage that passed DMARC. So the first days after an advance are judged on the new policy, not the old one. Days at Stage counts from the last change of policy — or, if the policy has never changed since, from the first time the wizard was opened for the domain.

Recommendation. Checked in this order, stopping at the first that applies:

1. At Reject Full: Full Enforcement Active.
2. Fewer than 100 messages reported in the last 7 days: Need More Data.
3. Fewer days at this stage than the stage's minimum: Keep Monitoring, with the number of days left.
4. Pass rate below the stage's threshold: Investigation Needed.
5. Otherwise: Ready to Advance.

Whose pass rate. The threshold is judged on your own senders — the sources in your reports that passed DMARC at least once in the last 7 days. Sources that never passed are often spoofing, and counting them would hold back exactly the domains that most need enforcement. They are not ignored: when they pull the overall pass rate below the threshold, the wizard shows how many messages came from them, because advancing will reject that mail if any of it is yours.

Policy changed elsewhere. If you change the policy with Edit configuration or the Setup Wizard, the wizard picks up the new policy the next time it loads, places the domain at the matching stage, and restarts the day count. A percentage between stages is placed at the lower stage — for example, p=quarantine; pct=50 counts as Quarantine Partial, and the next step takes it to 100%.

6. How to Use It

The wizard is in Email Authentication > Hosted Services > Hosted DMARC, under Moving to enforcement, below the domain's DMARC policy.

Check a domain

1. Choose the domain in the wizard's Select domain... list.
2. Read the progress bar across the five stages, the Current Policy badge, and the three figures: Days at Stage, Messages and Pass Rate.
3. Read the recommendation below them, its reason, and any blockers or warnings.

Advance to the next stage

1. When the recommendation is Ready to Advance, click Advance to <policy> (<percentage>%) — for example Advance to quarantine (10%).
2. Your Hosted DMARC record is updated to the next stage and the day count starts again. You will see Policy advanced — Your DMARC record has been updated.
3. The new record is published straight away. Resolvers may keep the old one for up to an hour.

The button appears only when the domain is ready, and an advance is refused until it is. There is no button to skip a stage or go back; to do either, change the policy with Edit configuration in the same page, and the wizard follows.

If the recommendation is Investigation Needed

1. Open Email Authentication > Reporting > DMARC Aggregate for the domain and find the sources that are failing.
2. For each one that is yours, fix its SPF (CertaSPF) or DKIM (Hosted DKIM).
3. Come back after a few days of new reports. The pass rate is always the last 7 days, so fixed senders show up as the old failures age out.

7. Inputs and Settings

The wizard itself has one input: the domain. Everything else about the record — reporting addresses, alignment, subdomain policy, forensic reports — is set in the DMARC policy panel above it, under Edit configuration.

8. Outputs and Results

For each domain

• Progress bar — the five stages, filled up to the current one.
• Current Policy — for example p=quarantine (10%).
• Days at Stage, Messages (last 7 days) and Pass Rate (last 7 days, all reported mail). The pass rate is green at 95% or above, amber from 85%, red below.
• Stage History — each stage the domain has left, newest first, with its policy, percentage, when it began and ended, and its pass rate and message count at the time.

Recommendations

Alerts

Alerts that matter while moving to enforcement are chosen per domain under Email Authentication > Manage Domains, in the domain's Alert monitoring panel. How they reach you is set in Settings > Notifications, under Email authentication.

• Your DMARC policy no longer matches your settings — the record receivers see differs from the one configured in CertaDNS, usually because it was edited at your DNS host.
• DMARC compliance fell below your threshold — the 7-day pass rate dropped below the percentage you set in Alert monitoring, with at least 100 messages to judge by.
• A sender we have not seen before appeared — worth checking before you advance.

9. How to Interpret Results

Normal

• Keep Monitoring straight after advancing. Every stage has a minimum stay.
• A low overall Pass Rate with Ready to Advance and a warning about sources that have never authenticated. That is spoofing being counted, which is what enforcement is for — as long as none of those sources is yours.
• Pass rate a little lower in the first days of a new stage. The figure covers the last 7 days, including reports from before you advanced.

Worth investigating

• Investigation Needed — one of your own services is failing SPF or DKIM, or is not aligned with your From: domain.
• Need More Data for weeks — reports are not arriving. Check that the domain's DMARC record is Live in Manage Domains and that managed reporting is on.
• The wizard shows a different policy from the one you expected — someone changed it with Edit configuration or the Setup Wizard. Stage History shows when.

Common mistakes

• Treating a warning as noise. The count of messages from never-authenticated sources is the mail that will be rejected. Check the source list in DMARC Aggregate before you advance.
• Advancing a domain whose record is published elsewhere. The wizard reports progress, but receivers still see your own record.

10. Common Issues and Explanations

"Could not load this domain's DMARC progress" — "DMARC configuration not found for this zone"

The domain has no Hosted DMARC configuration yet. Create one in the DMARC policy panel above the wizard with Create configuration, or run the Setup Wizard.

No advance button

The button appears only on Ready to Advance. Read the reason and blockers under the recommendation.

Messages and Pass Rate stay empty after setup

Receivers send aggregate reports about once a day, and the wizard's figures are refreshed daily. Allow two or three days after the record goes live.

Advanced, but receivers still see the old policy

The new record is published when you advance, but resolvers can cache the old one for up to an hour. If it is still old after that, check the domain's _dmarc record in Manage Domains — it must point at CertaDNS, not hold a record of your own.

"Already at final policy stage"

The domain is at p=reject, 100%. There is nothing further to advance to.

"Could not advance the policy"

The update did not save. The message underneath gives the reason; reload the page and try again.

11. Limits and Constraints

12. Related Features

• DMARC Reporting — the reports the wizard's figures come from, and where to find failing sources.
• CertaSPF and Hosted DKIM — fixing the senders that hold a domain back.
• BIMI — available once the domain reaches quarantine or reject.

13. Updates and Behavior Changes

• 30 September 2026. This article was rewritten to match the product. The wizard is under Hosted Services > Hosted DMARC, Moving to enforcement; it was briefly missing from the dashboard after Email Authentication moved to its own sections, and was restored in September 2026. The pass-rate check looks at your own senders rather than all reported mail and warns about mail from sources that have never authenticated; a policy changed outside the wizard is picked up automatically; figures cover the last 7 days of reports. Descriptions of a custom advance percentage and of API response formats were removed: the dashboard advances to each stage's standard percentage.
• 30 September 2026, later. Advancing now publishes the new record immediately rather than within the hour, and is refused until the domain is ready. A new stage's figures count only reports received since it began, and Stage History records when each stage began.