DMARC Enforcement Roadmap

This guide provides a structured approach to implementing DMARC and progressing from monitoring to full enforcement.

Overview

Moving to DMARC enforcement (p=reject) protects your domain from spoofing but requires careful preparation. Rushing to enforcement can break legitimate email delivery.

┌─────────────────────────────────────────────────────────────┐
│  Phase 1        Phase 2           Phase 3                   │
│  p=none    →    p=quarantine  →   p=reject                  │
│  Monitor        Soft Enforce      Full Enforce              │
│  2-4 weeks      4-8 weeks         Ongoing                   │
└─────────────────────────────────────────────────────────────┘

Phase 1: Discovery and Monitoring

Goal: Understand your email ecosystem before making changes.

Duration: 2-4 weeks minimum

Week 1: Initial Setup

DMARC Record:

v=DMARC1; p=none; rua=mailto:your-id@reports.mailshield.app

In this record and the ones below, replace your-id@reports.mailshield.app with your domain's full Reporting address, shown on the domain's Overview page in MailShield.

Tasks:

[ ] Publish DMARC record with p=none
[ ] Configure report delivery to MailShield
[ ] Ensure SPF record exists (even if basic)
[ ] Document known email sources

Week 2: Discovery

Tasks:

[ ] Review incoming DMARC reports
[ ] Identify all sending sources from reports
[ ] Match sources to known services
[ ] Flag unknown sources for investigation

Key metrics to track:

Metric	Target
Report coverage	Reports from major providers (Google, Microsoft, Yahoo)
Source identification	80%+ of volume from identified sources
SPF pass rate	Baseline established
DKIM pass rate	Baseline established

Weeks 3-4: Remediation

Tasks:

[ ] Add missing services to SPF record
[ ] Configure DKIM for services that support it
[ ] Investigate and resolve unknown sources
[ ] Re-check pass rates

Only add services that send mail as your domain. Mail that people forward from their Gmail or Outlook mailbox fails SPF by design: adding Google or Microsoft to your SPF record for it would let every one of their users pass SPF as your domain. MailShield leaves this forwarded mail out of your pass rates.

Decision checkpoint: Ready for Phase 2 when:

✅ All legitimate senders identified
✅ SPF includes all sending services
✅ DKIM configured where available
✅ DMARC pass rate > 95% for known senders

Let MailShield do the bookkeeping

The DMARC Progression page for each domain (the domain's Reports → DMARC Progression) runs this checkpoint for you. It groups the last 30 days of reports by sending IP, marks a source as known when it already sends DMARC-passing mail for your domain, is a recognized email provider, or has a hostname under one of your domains, and lists every known source that still fails together with the reason. It also separates mailing lists and third-party senders from unauthenticated mail sent by sources it cannot tie to you, so you can see what a stricter policy would actually block.

Mail forwarded from mailboxes such as Gmail or Outlook doesn't count toward the alignment rate, the data check or any source list. SPF fails for it at the forwarding server by design, so there's nothing to fix: the page lists it in a collapsed Forwarded mail section, with how much of it still passed DKIM. For sources that pass on DKIM alone, that's fine while the signature stays intact. For SPF to align as a backup, set up a custom return-path (bounce) domain with the service, as described in Third-Party Senders. The same per-source table is available on the Reports page for any date range.

Phase 2: Soft Enforcement

Goal: Test enforcement with safety net.

Duration: 4-8 weeks

Week 5-6: Initial Quarantine

DMARC Record:

v=DMARC1; p=quarantine; pct=10; rua=mailto:your-id@reports.mailshield.app

What happens:

10% of failing messages go to spam
90% delivered normally
You see impact without full exposure

Tasks:

[ ] Update DMARC record to p=quarantine; pct=10
[ ] Monitor for delivery complaints
[ ] Check reports for unexpected failures
[ ] Verify no legitimate mail in spam

Week 7-8: Increase Coverage

Progression:

pct=10  →  pct=25  →  pct=50  →  pct=75  →  pct=100

DMARC Record (example at 50%):

v=DMARC1; p=quarantine; pct=50; rua=mailto:your-id@reports.mailshield.app

Tasks per increment:

[ ] Update pct value
[ ] Wait 3-5 days
[ ] Check for delivery issues
[ ] Review DMARC reports
[ ] Proceed or rollback based on results

Week 9-12: Full Quarantine

DMARC Record:

v=DMARC1; p=quarantine; rua=mailto:your-id@reports.mailshield.app

Tasks:

[ ] Remove pct tag (defaults to 100)
[ ] Monitor for 2+ weeks at full quarantine
[ ] Ensure no legitimate mail issues

Decision checkpoint: Ready for Phase 3 when:

✅ 2+ weeks at p=quarantine with no issues
✅ DMARC pass rate > 99% for legitimate mail
✅ No delivery complaints from users
✅ All authentication issues resolved

Phase 3: Full Enforcement

Goal: Maximum protection against spoofing.

Duration: Ongoing

Transition to Reject

Option A: Gradual (Recommended)

Start with percentage-based reject:

v=DMARC1; p=reject; pct=10; rua=mailto:your-id@reports.mailshield.app

Progress through: pct=10 → pct=25 → pct=50 → pct=100

Option B: Direct (If confident)

If quarantine phase was smooth:

v=DMARC1; p=reject; rua=mailto:your-id@reports.mailshield.app

Final Record

Production DMARC record:

v=DMARC1; p=reject; rua=mailto:your-id@reports.mailshield.app; adkim=r; aspf=r

With subdomain policy:

v=DMARC1; p=reject; sp=reject; rua=mailto:your-id@reports.mailshield.app

Decision Trees

When to Progress

Current phase stable for 1-2 weeks?
        │
        ├── No → Continue monitoring
        │
        └── Yes → Pass rate > 99%?
                        │
                        ├── No → Fix issues first
                        │
                        └── Yes → Any delivery complaints?
                                        │
                                        ├── Yes → Investigate and resolve
                                        │
                                        └── No → ✅ Safe to progress

When to Pause or Rollback

Pause if:

New sender discovered that needs configuration
Delivery complaints from legitimate recipients
Pass rate drops significantly

Rollback if:

Business-critical email failing
Unable to resolve issues quickly
Customer-facing email affected

Rollback Procedure

Step 1: Reduce enforcement immediately

# From reject to quarantine
v=DMARC1; p=quarantine; rua=mailto:your-id@reports.mailshield.app

# Or from quarantine to none
v=DMARC1; p=none; rua=mailto:your-id@reports.mailshield.app

Step 2: Investigate the issue

Check DMARC reports for failing source
Identify the service/sender
Determine root cause

Step 3: Remediate

Add to SPF if missing
Configure DKIM if available
Test authentication

Step 4: Resume progression

Return to previous enforcement level
Monitor for 1 week
Continue progression

Metrics to Track

By Phase

Metric	Phase 1	Phase 2	Phase 3
DMARC pass rate	Baseline	> 95%	> 99%
Identified sources	80%+	95%+	100%
SPF pass rate	Baseline	> 90%	> 95%
DKIM pass rate	Baseline	> 90%	> 95%
Delivery complaints	N/A	Zero	Zero

Key Indicators

Positive signals:

✅ Consistent high pass rates
✅ No new unknown sources
✅ Zero delivery complaints
✅ Reports from major providers

Warning signals:

⚠️ New unidentified senders appearing
⚠️ Pass rate fluctuations
⚠️ Missing reports from expected providers
⚠️ User complaints about email delivery

Timeline Summary

Week	Phase	Policy	pct	Key Actions
1-2	1	none	-	Setup, initial discovery
3-4	1	none	-	Remediation, SPF/DKIM config
5-6	2	quarantine	10	Begin soft enforcement
7-8	2	quarantine	25-50	Increase coverage
9-10	2	quarantine	75-100	Full quarantine
11-12	2	quarantine	100	Stabilization
13-14	3	reject	10-50	Begin full enforcement
15+	3	reject	100	Production, ongoing monitoring

TIP

This timeline is a guideline. Move faster if your domain has simple email infrastructure, or slower if you have many third-party senders.

Special Considerations

Multiple Subdomains

Consider subdomain policy (sp) carefully:

# Enforce on main domain, monitor subdomains
v=DMARC1; p=reject; sp=none; rua=mailto:reports@...

# Enforce everywhere
v=DMARC1; p=reject; sp=reject; rua=mailto:reports@...

Parked/Unused Domains

Skip the monitoring phase for domains that don't send email:

v=DMARC1; p=reject; rua=mailto:your-id@reports.mailshield.app

Also add restrictive SPF:

v=spf1 -all

Acquisitions/Mergers

When acquiring new domains:

Start at Phase 1 regardless of parent domain status
Complete full progression
Consider separate report streams initially

Next Steps

Email Source Discovery - Audit your senders
Third-Party Senders - Configure external services

DMARC Enforcement Roadmap ​

Overview ​

Phase 1: Discovery and Monitoring ​

Week 1: Initial Setup ​

Week 2: Discovery ​

Weeks 3-4: Remediation ​

Phase 2: Soft Enforcement ​

Week 5-6: Initial Quarantine ​

Week 7-8: Increase Coverage ​

Week 9-12: Full Quarantine ​

Phase 3: Full Enforcement ​

Transition to Reject ​

Final Record ​

Decision Trees ​

When to Progress ​

When to Pause or Rollback ​

Rollback Procedure ​

Metrics to Track ​

By Phase ​

Key Indicators ​

Timeline Summary ​

Special Considerations ​

Multiple Subdomains ​

Parked/Unused Domains ​

Acquisitions/Mergers ​

Next Steps ​

DMARC Enforcement Roadmap

Overview

Phase 1: Discovery and Monitoring

Week 1: Initial Setup

Week 2: Discovery

Weeks 3-4: Remediation

Phase 2: Soft Enforcement

Week 5-6: Initial Quarantine

Week 7-8: Increase Coverage

Week 9-12: Full Quarantine

Phase 3: Full Enforcement

Transition to Reject

Final Record

Decision Trees

When to Progress

When to Pause or Rollback

Rollback Procedure

Metrics to Track

By Phase

Key Indicators

Timeline Summary

Special Considerations

Multiple Subdomains

Parked/Unused Domains

Acquisitions/Mergers

Next Steps