Start from each Author Domain

List the exact domains used in visible From addresses: for example, billing.example.com, news.example.com, and example.com. For each one, query _dmarc.<author-domain> first. Under RFC 9989, if no valid record is found there, a bounded DNS tree walk looks for applicable records at higher levels.

Record every DMARC policy record encountered, including psd signals, rather than jumping directly to the apex. Receiver implementations may be in transition from RFC 7489 behavior, so compare controlled receiver evidence with the current standard.

Distinguish three policy tags

p applies according to where the applicable policy is found. When an organizational-domain or public-suffix policy applies to a subdomain, sp can specify the policy for existing subdomains. np can specify policy for non-existent subdomains. If the applicable tag is absent, RFC 9989 defines fallback to p for subdomains.

Do not add sp or np without understanding whether the Author Domain exists in DNS and where the policy is discovered. Invalid policy tags can change how a record is treated.

Design ownership boundaries

If a business unit must own a distinct policy or reporting destination, an explicit valid DMARC record at its Author Domain can create that boundary. The psd=n signal can identify an organizational-domain boundary in current discovery, but deep hierarchies and the eight-query protection require careful testing. RFC 9989 recommends an explicit record at very deep Author Domains that might otherwise be skipped.

Map each domain to its owner, legitimate senders, alignment modes, policy, report destinations, and rollback. Avoid wildcard assumptions; DMARC uses records at specified _dmarc names and tree-walk logic.

Verify with examples

For an existing subdomain and a deliberately non-existent test subdomain you control, calculate the expected discovery without sending abusive or spoofed traffic. Query authoritative DNS and use a current local evaluator. Then send authorized mail only from real legitimate streams and inspect trusted results.

The plan is complete when every production From domain has a predictable applicable record and accountable owner, and defensive policy for unused names is documented. “The apex has DMARC” is not sufficient evidence for a complex delegated namespace.