DMARC enforcement is straightforward to configure and easy to get wrong in a way that silently drops legitimate mail. The whole method is to inventory your senders first and move the policy in stages while watching reports.
Inventory every sending source first. Marketing platforms, invoicing systems, the helpdesk, monitoring alerts, HR tools, and the scanner in the corner all send as your domain. Missing one means its mail starts failing the day you enforce.
Watch the SPF lookup count. SPF allows ten DNS lookups. Each `include:` consumes some, and exceeding the limit causes a permanent error that fails SPF for all your mail. Count them before adding another vendor.
Move the policy in stages with real soak time. p=none to gather reports, then quarantine at a low percentage, then increase, then reject. Allow several weeks at each stage, long enough to catch monthly and quarterly senders such as payroll and statements.
Here's a preview. Unlock the free download to get all 3 sections (2 more below).
Everything that sends as your domain. The one you forget is the one that breaks.
| Sending source | Purpose | Owner | In SPF | DKIM signing | Aligned | Notes |
|---|---|---|---|---|---|---|
| Microsoft 365 | Staff mail | IT Ops | Yes | Yes | Yes | Primary |
| Marketing platform | Campaigns and newsletters | Marketing | Yes | Yes | Yes | Custom signing domain configured |
More free templates IT teams use alongside this one.
DNS accumulates records faster than anyone removes them, and a CNAME pointing at a decommissioned cloud resource is a subdomain takeover waiting to be found by someone else. This inventory makes stale records visible.
A simulation programme that always sends easy lures produces flattering numbers and teaches nothing. Recording difficulty alongside results is what makes the trend meaningful rather than a function of how gentle you were feeling.
Annual click-through training produces a completion certificate and no behaviour change. A programme that works is short, frequent, role-specific, and measured against behaviour rather than against attendance.
Inventory your sending sources, publish SPF and configure DKIM for each one, then publish DMARC at p=none to gather reports. Only move to quarantine and then reject once reports show every legitimate source passing with alignment.
Long enough to identify every legitimate sender and fix alignment, typically four to eight weeks in total. The period must cover at least one month-end so that payroll, statements, and other periodic senders appear in the reports.
SPF evaluation permits a maximum of ten DNS lookups, and each `include:` consumes at least one. Exceeding it produces a permanent error that fails SPF for all your mail, so adding one vendor too many can silently break deliverability.
