Prepare the receiving side first

Choose an address or approved reporting service that can accept compressed DMARC aggregate reports, validate them safely, deduplicate them, and retain only what policy permits. Reports can be numerous. Assign an owner and an investigation cadence before publishing rua; an abandoned mailbox creates data without control.

If the destination’s organizational domain differs from the domain publishing DMARC, coordinate the external-destination authorization required by RFC 9990. Confirm the processor’s data terms and access controls. Aggregate reports are designed around domain-level authentication data, but they still reveal sending infrastructure and traffic patterns worth protecting.

Publish a minimal current record

For example.com, an illustrative starting record is:

_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

The domain is reserved for examples. v=DMARC1 must be first and p is required. p=none asks receivers not to change existing message handling because of the DMARC policy; receivers still apply their normal anti-abuse controls.

Do not copy historic pct, rf, or ri advice into a new RFC 9989 record. Add optional tags only for a defined operational reason. Publish one valid DMARC policy record at the name.

Validate DNS and real messages

Query authoritative and recursive DNS. Send fresh messages from every known stream and inspect trusted Authentication-Results. Record the visible From domain, passing SPF domain, passing DKIM domains, and which path aligns.

Then process reports by reporter, source IP, count, disposition, SPF identifiers/results, DKIM identifiers/results, and alignment. A source with DMARC pass can still be unauthorized; a source with fail can be legitimate but misconfigured. Reports are investigation leads, not an automatic allowlist.

Create the review loop

Map known sources to owners, investigate unknown high-volume sources, and fix legitimate alignment failures. Track coverage gaps: not every receiver sends reports, report timing varies, and current traffic may omit seasonal systems.

Set an evidence-based next review date. Monitoring is successful when the organization can explain its material streams and act on failures. It is not a permanent end state by default, and it is not proof that enforcement is safe after only a few quiet days.