Move DMARC from monitoring to enforcement

01Before changing the policy

A monitoring policy provides visibility into DMARC results. Moving to quarantine or reject changes what your domain asks receiving systems to do with failing mail. The NCSC recommends a phased implementation with continued review. Give the work an email administrator, an agreed change window and a contact who can respond if a legitimate mail stream fails.

02Implementation checklist

1. Record every authorised sender, its business owner and the From domains it uses. Include occasional mail such as annual statements and password resets.
2. Check that each sender passes aligned SPF or aligned DKIM using real received messages. A published record is only part of the evidence.
3. Review SPF syntax and evaluation limits. Publish one SPF record per owner name; check the RFC’s limit on DNS-causing terms, including nested lookups, with a suitable validator.
4. Collect and examine aggregate reports over a period that includes your important sending patterns. Investigate legitimate failures and unknown sources.
5. Agree the enforcement change, tests and rollback instructions with the people responsible for DNS and email delivery. Do not paste a policy copied from another business.
6. Introduce the reviewed quarantine or reject policy, then watch reports and delivery issues. Keep reviewing new services and changes to existing senders.

03Evidence of completion

Save the approved sender inventory, DNS change record, tested message results and review date. Record remaining exceptions honestly. A public DNS check can confirm the published policy it observed, but cannot establish that every legitimate message passes or that every receiver will act identically.