Define readiness before choosing a policy

List every material source observed in aggregate reports and every expected low-frequency stream. For each, record the owner, visible From domain, SPF identity/result/alignment, DKIM identity/result/alignment, volume, and last fresh receiver test. Legitimate streams need at least one reliable aligned authentication path; where possible, operate both SPF and DKIM correctly.

Investigate unknown sources. Some are abuse, some are forgotten services, and some are shared infrastructure that needs more evidence. Do not authorize a source merely to improve a pass percentage.

Review indirect paths

Forwarders and mailing lists can change the connecting IP or message content. Test important business flows such as support lists, alumni groups, gateways, and ticketing systems. Record actual receiver outcomes and mitigations such as surviving aligned DKIM or receiver use of ARC; neither is a universal guarantee.

Plan scope under current DMARC

RFC 9989 removed the historic pct tag because intermediate percentages were inconsistently implemented. Do not plan a “10%, 25%, 50%” rollout as if every receiver will sample the same way. Instead, use controlled sender remediation, explicit Author Domain or subdomain policy design, bounded organizational rollout, and the current t testing signal only after understanding its defined semantics and receiver deployment.

Choose whether quarantine or reject reflects the domain’s real use. RFC 9989 warns that domains used for general-purpose email should not casually deploy p=reject, because legitimate indirect mail can be affected. Document the business and interoperability decision rather than treating reject as a universal maturity badge.

Change with rollback

Capture the exact old and new DNS values, approval, TTL, deployment time, expected effect, monitoring window, and rollback triggers. Query authoritative and recursive DNS. Send new tests from all major streams and monitor reports, SMTP failures, support contacts, and indirect-flow evidence.

If legitimate traffic regresses, use the recorded rollback while fixing the source. Do not stack alignment or provider changes during the same observation window unless incident containment requires it.

Enforcement readiness means the organization knows what it may disrupt, has chosen that risk deliberately, and can verify and reverse the change. A high aggregate pass rate alone cannot make that decision.