Moving DMARC to reject without breaking your mail

Moving to p=reject never breaks a correctly authenticated message. The question is therefore not “is rejection dangerous” but “have I actually inventoried everything that sends in my name”. The typical casualty is not the main mail system, which is always identified: it is the invoicing package bought six years ago, the recruitment platform, the e-signature tool, the newsletter an intern set up.

Those senders are not recovered by memory. They are recovered from the aggregate reports, which list every IP address that sent under your name, whatever the reason.

1. 01

   Stage 0 · Establish what exists

   Before publishing anything, look at what is already there. A forgotten record, two competing SPF records, an expired DKIM key: half the difficulties are visible at this point.

   dig +short TXT example.com
   dig +short TXT _dmarc.example.com

2. 02

   Stage 1 · Observe, two to four weeks

   Publish a policy that blocks nothing and a report address on a dedicated mailbox. Allow a full monthly cycle: payroll, reminders, the quarterly newsletter if it falls in the window.

   _dmarc  IN  TXT  "v=DMARC1; p=none; rua=mailto:reports@example.com"

3. 03

   Stage 2 · Inventory and align

   For every source appearing in the reports, decide: legitimate or not. Each legitimate source then has to align on at least one of the two checks. In practice DKIM is the simpler: most providers offer to have you publish two or three records on your domain, and alignment follows.

4. 04

   Stage 3 · Handle the providers' SPF case

   A provider sending with its own return address passes SPF on its own domain, so alignment fails. The fix is to enable a custom return path with them, under a subdomain of yours, then publish the record they give you. Watch the ten-lookup limit while you are there: this is the moment it gets exceeded.

5. 05

   Stage 4 · Quarantine, one to two weeks

   Once the reports show only known, aligned sources, move to quarantine. This stage exists to catch the forgotten sender: their messages go to junk and somebody complains, instead of disappearing silently.

   _dmarc  IN  TXT  "v=DMARC1; p=quarantine; rua=mailto:reports@example.com"

6. 06

   Stage 5 · Reject, then strict alignment

   Two weeks without incident, and rejection can be published. Strict alignment comes afterwards, separately: it is a second change with its own week of observation, because it invalidates the subdomains that were passing on tolerance until then.

   _dmarc  IN  TXT  "v=DMARC1; p=reject; rua=mailto:reports@example.com;
                      adkim=s; aspf=s"

An aggregate report is a compressed XML file, sent once a day per provider. Opened in a text editor it is unreadable. What you are looking for, though, comes down to three questions.

1. Which IP addresses are sending under my name, and which do I not recognise?
2. For each recognised source, is alignment achieved through SPF, through DKIM, or through neither?
3. Is the volume from an unknown source increasing?

A small firm's volumes are low: a few dozen sources in total, of which three or four account for 95% of traffic. Once the inventory is done, the monthly read takes a few minutes.

It protects your domain name. It does nothing against a cousin domain or a misleading display name, both covered in the article on what DMARC does not stop.

It also assumes you know the list of your own domains. Registered trade marks, former trading names and defensively bought domains are regularly forgotten, and those are the ones nobody watches.