Teaser only. This is not the full article. Complete week-by-week rollout with pct= staging: Roll Out DMARC p=reject in 8 Weeks
Finance wants p=reject yesterday. Marketing still sends through three ESPs nobody documented. Flip the policy in one afternoon and payroll receipts start bouncing.
A sane rollout stages enforcement while you read aggregate reports. Start at p=none with rua=, move to quarantine with pct=, watch failure sources, then reject when alignment is boring for two straight weeks.
Baseline check:
dig _dmarc.example.com TXT +short
You want rua= receiving XML before you touch p=.
In the full post on zerohook.org:
- Week-by-week checklist (8 weeks)
- pct=25 staging without breaking transactional mail
- Identifying shadow senders in aggregate XML
- Rollback plan when a vendor surprises you
Read the full guide: Roll Out DMARC p=reject in 8 Weeks
Top comments (1)
Solid structure. One practical addition: before moving
pct=up each week, check your aggregate reports to confirm legitimate sources you may have forgotten, things like CRM tools, helpdesk platforms, or transactional email services. Jumping top=rejectwith an incomplete sender inventory is the most common reason organisations have to roll back. (disclosure: I run SealedMail)