Record the discovery context

Name the Author Domains affected, the exact DMARC policy domain, and every applicable parent record found through current policy discovery. Include p, sp, np, adkim, aspf, psd, t, and report destinations when present. A change at an organizational domain can affect subdomains that have no explicit record.

Capture authoritative DNS answers, resolver views, observed TTLs, and query times. Keep the complete old record as a rollback value; a screenshot of selected tags is not enough.

Attach the evidence for change

Summarize aggregate-report periods and participating reporters, material source counts, known sender coverage, remaining unknowns, and fresh receiver tests. Include important indirect flows and low-frequency streams. State the limitation: reports do not cover every receiver or prove inbox placement.

Write the decision in plain language: “Move p=none to p=quarantine for domain X because all approved streams have an aligned path; unresolved sources Y and Z are classified as unauthorized.” Name the approver and business risk owner.

Define deployment and rollback

Store:

  • scheduled UTC time and operator;
  • exact candidate record;
  • syntax and current-standard validation;
  • expected receiver and report changes;
  • observation window and dashboards;
  • rollback triggers and exact prior value;
  • escalation contacts.

Do not use the historic pct tag as a percentage rollout. If a scoped Author Domain or subdomain strategy is used, document why its policy discovery is predictable.

Verify after publication

Query authoritative and recursive DNS, then send fresh messages from representative streams. Inspect trusted Authentication-Results and monitor SMTP failures, support reports, aggregate data, and report-ingestion errors. Keep local receiver policy and overrides distinct from the domain owner’s requested assessment policy.

If rollback is required, publish the prior record and verify it with the same checks. Cached answers mean reversal is not instantaneous; communicate that uncertainty.

Close with facts

Record actual outcome, unexpected behavior, final value, and next review. Link remediation items to owners. The change log should allow an independent operator to reconstruct what receivers were expected to discover and why the organization accepted the effect. It should never contain private keys, customer message bodies, or invented certainty about providers that did not report.