IT Toolbox
Guide

How to deploy DMARC gradually without blocking legitimate emails

A DMARC policy must be gradually deployed to identify all legitimate sources before moving to the quarantine or the mundane.

TopicActive Directory →
⌚ About 2 min read
View my favorites
Email / DNS. Intermediate. 30 min.

A DMARC policy must be gradually deployed to identify all legitimate sources before moving to the quarantine or the mundane.

Avant de commencer : adaptez toujours les commandes et manipulations à votre environnement. Sur un système de production, prévoyez une backup ou un retour arrière lorsque l’action peut modifier la configuration.

Étapes à suivre

  1. 1

    Inventory senders.

    List Microsoft 365, CRM, website, marketing tools and business applications.

  2. 2

    Validate SPF and DFIM

    Each source must properly align SPF or DHIM with the From domain.

  3. 3

    Start observation

    Publish p=none with a dedicated report address.

  4. 4

    Analyze reports.

    Correct unaligned sources and forgotten services.

  5. 5

    Stepwise strengthening.

    Go to the quarantine and then to the mundane only when legitimate traffic is controlled.

Commands utiles

ns Outlookup -type=txt _dmarc.example.fr.
ns Outlookup -type=txt example.fr.

À retenir

  • DMARC does not replace SPF or DFIM.
  • Avoid exceeding the SPF DNS search limits.
  • Do not post p=reject on the first day on a complex active domain.
← All les guides
Technical deep dive

DMARC: alignment matters as much as SPF or DKIM

Technical checkpoints

  • DMARC passes when aligned SPF OR aligned DKIM passes; SPF pass on a non-aligned domain is not enough.
  • p=none collects reports without requesting enforcement; quarantine and reject should follow real source analysis.
  • pct supports gradual enforcement, while sp can define a separate subdomain policy.

Progressive rollout

Start in monitoring

v=DMARC1; p=none; rua=mailto:dmarc@example.com
... then p=quarantine / p=reject

Topic-specific pitfalls

  • Jumping directly to reject without analyzing SaaS and indirect senders creates false rejects.
  • Aggregate reports describe volumes and domains; they do not replace headers from a specific message.

How to validate

  • Main legitimate sources are aligned and visible in rua reports.
  • A real message shows dmarc=pass with the expected organizational From domain.
♡ 0