From p=none to Enforcement: A Working Sequence for DMARC Rollout

DMARC rollout is easy to start but challenging to complete. The policy record is simple to publish, yet moving to enforcement without blocking legitimate mail can take months. The real issue is the lack of a defined sequence for transitioning from p=none to enforcement. This article outlines a logical sequence that addresses common pitfalls and ensures a successful DMARC rollout.

The key to a successful rollout is building a comprehensive inventory of sending sources. This includes identifying every source that sends mail on behalf of the domain, noting the sending service or host, the business owner, configuration for SPF and DKIM, alignment with the organisational From domain, and the volume and recipient population. Third-party senders should be treated separately, as they often cannot be configured for DKIM without a support request.

The recommended rollout sequence is as follows:

1. Publish p=none with rua= reporting. Verify that reports are being received and parsed correctly. Align SPF and DKIM for every known source before changing the policy. A source that passes SPF but fails alignment will fail DMARC.

2. Gradually increase the pct= tag in steps, allowing partial application. Start at a low percentage to limit the blast radius of an unknown sender. After each step, observe the aggregate reports for new failures and define a clear observation period.

3. Once alignment is successful for all sources, move to p=quarantine with a low percentage. This allows delivery of authenticated mail while still catching potential issues.

4. Increase the pct= tag again in steps, followed by observation periods and checks of aggregate reports. This process helps identify any remaining failures and ensures a smooth transition.

5. Finally, move to p=reject. This final policy prevents delivery of unauthenticated mail using the domain. If managing subdomains is necessary, add sp=reject for subdomains once the full inventory is complete.

BIMI (Brand Indicators for Message Identification) is a downstream consumer of enforced DMARC policy and requires DMARC enforcement as a prerequisite. Pursuing BIMI before achieving DMARC enforcement can lead to a false sense of security, as attackers may resort to lookalike domains or display-name spoofing.

Enforcing a DMARC policy does not eliminate all phishing attempts, but it does stop unauthenticated mail using the domain in the visible From field. Attackers will adapt to new controls, so it is essential to maintain a disciplined report-reading process and continuously monitor the aggregate reports for new failures. Ignoring reports or treating them as mere compliance artifacts undermines the entire rollout process.

In summary, a successful DMARC rollout requires careful planning, a comprehensive sending-source inventory, and a disciplined approach to reading and interpreting aggregate reports. By following this sequence and addressing potential failure modes, organizations can achieve a robust DMARC enforcement policy that protects their brand and email ecosystem.