DMARC adds alignment checking — verifying that SPF or DKIM domains match the visible From header — plus a policy for failures.
DMARC deployment roadmap:
| Phase | Policy | Duration |
|---|---|---|
| 1. Monitor | p=none; rua=mailto:... |
2–4 weeks |
| 2. Fix | p=none continues |
2–8 weeks |
| 3. Soft quarantine | p=quarantine; pct=10 |
2–4 weeks |
| 4. Ramp | p=quarantine; pct=25→100 |
4–8 weeks |
| 5. Soft reject | p=reject; pct=10 |
2–4 weeks |
| 6. Full reject | p=reject; pct=100 |
Ongoing |
Relaxed vs. strict alignment: Relaxed allows subdomain matching (recommended). Strict requires exact domain match.
The total journey typically takes 3–6 months for mid-size organizations.
Sign in to keep track of what you have read.