Skip to content
SESaratoga Edge
← Email, Security & Cloud Foundations

Draft — in editorial review, not yet published. Content has not been approved by a human reviewer.

Lesson 44 / 50 · Version 2.2.0

DMARC Alignment and Rollout

Level
Intermediate
Duration
15 min learn + 15 min apply
Prerequisites:
Lessons 41–43

Why it matters: DMARC is what stops others from sending mail that looks like it comes from your domain, and large mailbox providers increasingly expect bulk senders to publish it. Rolled out carelessly, it blocks your own invoices.

By the end you can:

  • Explain alignment and what DMARC protects
  • Read the main policy tags
  • Plan a staged rollout from monitoring to enforcement
  • Interpret simple aggregate-report findings

Learn (15 min)

1. DMARC ties authentication to the visible From (5 min)

DMARC passes when SPF or DKIM passes and aligns with the domain in the visible From header. One aligned pass is enough. It defends against direct spoofing of your domain; SPF and DKIM supply the evidence.

2. The policy record (5 min)

_dmarc.example.org. TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.org; adkim=r; aspf=r"
TagMeaning
p=Requested handling for failures: none, quarantine, reject
rua=Where aggregate reports go
adkim / aspfAlignment mode: r relaxed (default) or s strict
sp=Policy for subdomains (if different)
Reports are XML summaries by sending source. They can be large and operationally sensitive, so use a monitored mailbox or a reporting tool with access controls.

3. Roll out in stages (5 min)

  1. Inventory every legitimate sender (staff mail, CRM, billing, newsletters, apps).
  2. Authenticate each with SPF and/or DKIM that aligns.
  3. Publish p=none with rua and review reports for weeks.
  4. Fix legitimate failures; investigate unknown sources (don't automatically authorize them).
  5. Move to quarantine, then reject, in steps, monitoring after each. Handle subdomains deliberately. DMARC is a signal to receivers; handling can vary.

Apply (15 min)

Worked example (3 min). Report summary: staff mail (SPF and DKIM pass, aligned), CRM (DKIM aligned pass, SPF fail), unknown server (both fail). Meaning: staff mail and CRM already pass DMARC; the CRM's SPF issue is low priority since DKIM covers it; the unknown server needs investigation (could be forgery or a forgotten system). Moving to reject now would be premature until the unknown source is understood.

Lab (7 min): Plan the rollout.

  1. Write your sender inventory with SPF/DKIM status for each.
  2. Draft the p=none record you'd publish and where reports go.
  3. Write the criteria for moving to quarantine (e.g., all legitimate senders aligned for 30 days).
  4. Write what you'd do when a new vendor appears.

Deliverable: A rollout plan with exit criteria for each stage. You're done when: Each stage has an objective, a duration, and a rollback step.

Check yourself (5 min)

  1. What visible identity does DMARC protect?
  2. Must both SPF and DKIM pass?
  3. What does p=none request?
  4. Scenario: Reports show a source you don't recognize sending 5,000 messages as your domain. What do you do?
  5. Why avoid jumping to p=reject?

Reference

Common mistakes

SymptomLikely causeFix
Legit mail rejectedEnforced before inventoryReturn to p=none; fix senders
No reportsBad rua address/formatCheck mailbox and syntax
Subdomain spoofingSubdomains not consideredSet sp= and authenticate subdomains

Cheat sheet: Inventory → authenticate all real senders → monitor p=none → fix failures → enforce in stages → maintain.

Key terms: DMARC, alignment, aggregate report, policy, subdomain policy.

Interview prompts: How do you roll out DMARC without breaking invoices?

Go deeper: DMARC specification (RFC 9989) · Microsoft: Set up DMARC · How email authentication works

Next: Lesson 45 — Microsoft 365 deliverability.