Engineering capabilities
- Monitoring policy with aggregate reporting
- Report analysis and sender remediation
- Staged progression to quarantine then reject
- Subdomain policy and alignment mode design
Security & DNS
DMARC
The policy layer that tells receivers what to do with mail failing SPF and DKIM alignment, moved to enforcement in stages so legitimate mail is never lost.
Security & hardening
- Spoofing of the domain becomes materially harder at enforcement
- Ongoing aggregate report monitoring for new abuse
- Forensic reporting where the receiver supports it
DMARC enforcement rollout
Policy is raised in steps, guided by aggregate reports, so spoofing is blocked without collateral damage to legitimate mail.
-
01
Monitor
- p=none
- rua reporting address
- Baseline period
Two to four weeks of reporting establishes who is really sending as the domain.
-
02
Remediate
- Unaligned sender fixes
- SPF updates
- DKIM signing added
Every legitimate source is brought into alignment before policy moves.
-
03
Quarantine
- p=quarantine
- pct ramp
- Report review
Percentage ramp limits exposure while behaviour is confirmed.
-
04
Reject
- p=reject
- sp policy
- Ongoing monitoring
Enforcement with continued report monitoring so new senders are caught early.
Frequently asked questions
Will DMARC block our own mail?
Not if the rollout is staged. Policy stays at monitoring until reports show every legitimate source authenticating and aligning, which is exactly what the reporting phase is for.
How long does it take to reach reject?
Typically six to twelve weeks for a normal estate, longer where many third-party platforms send on the domain.
What does alignment mean?
The domain in the visible From address must match the domain validated by SPF or DKIM. Authentication can pass while alignment fails, and DMARC only accepts an aligned pass.
Scope the work before you commit budget
Send the environment details and get an engineered proposal with assumptions, risks and a rollback path.