Skip to content
Academy
Marketing Academy · Field Work●Email & Lifecycle
All projects·From: Deliverability: SPF, DKIM, DMARC
CoreSimulation· 35 minutes

The DMARC Rollout: Deciding When to Tighten Enforcement

Squarespace

Objective: Given a series of weekly DMARC aggregate report snapshots during a p=none to p=reject rollout, decide at each stage whether to hold, ramp up, or roll back enforcement.

You're managing the DMARC rollout for Squarespace's customer email domain. You started at p=none four weeks ago and must decide, week by week, whether the data supports moving to enforcement.

At each weekly checkpoint, read the alignment pass rate and unresolved sender list, then choose the correct next action instead of following a fixed calendar.

Before you start

What you'll need

Free path (everything below is enough to finish)

Google Sheets
FreeTrack weekly alignment pass rate and unresolved sender list across the rollout

Sufficient for logging a handful of weekly snapshots without a dedicated DMARC platform

Paid upgrades (optional, faster/deeper)

Klaviyo(optional)
FreemiumConfirm which campaign sends originate from the ESP side of the domain during the rollout

Cross-checking the ESP's own send logs against DMARC report source IPs speeds up identifying unresolved senders

The process

2 steps

Step 01 of 02

Reading DMARC aggregate reports to find unresolved senders

A DMARC rollout only moves from p=none toward enforcement once every legitimate sending source on the domain passes SPF or DKIM alignment; an aggregate report's alignment percentage can look high while a single unresolved sender still risks losing real mail.

Week 1's aggregate report shows 71% alignment with 3 unresolved senders (a billing tool, calendar invites, and an old CRM). Do you hold at p=none or start ramping enforcement?

Google Sheets— Weekly DMARC aggregate report export, logged into a rollout tracking sheet.

Procedure

  1. Log the week's overall alignment pass rate and the full unresolved sender list
  2. Identify each unresolved sender by name, not just count
  3. Hold enforcement at p=none if any unresolved sender remains, regardless of the overall percentage
Sample output
Week 1 (p=none)
  Alignment pass rate: 71%
  Unresolved senders: billing tool, calendar invites, old CRM
  Decision: HOLD, fix senders before considering enforcement

Healthy

The decision holds at p=none because 3 senders are still unresolved, even though 71% looks like a reasonable-sounding number in isolation.

Unhealthy

Treating 71% alignment as 'good enough' and moving to p=quarantine while 3 real senders would start losing mail.

What this means

The unresolved sender list, not the percentage, is what gates the next enforcement stage.

So what do I do about it?

SymptomActionEffort
Alignment percentage looks acceptable but some legitimate mail keeps getting flaggedCheck the unresolved sender list by name before touching the DMARC policy5 min
YouYou can do this yourself, no engineering access required.

Step 02 of 02

Percentage-based enforcement ramp (pct=)

DMARC's pct= tag lets a domain apply a stricter policy to only a percentage of mail at first, so a domain moving into p=quarantine or p=reject ramps pct= gradually (e.g. 10, then 25, then 100) rather than flipping to full enforcement in one step.

By Week 4, alignment has reached 99.2% with zero unresolved senders for a full week. What's the correct next move?

Google Sheets— Same weekly rollout tracking sheet, now at the 4-week mark.

Procedure

  1. Confirm alignment has held above roughly 98% for a full week, not just a single snapshot
  2. Confirm zero unresolved senders remain on the current week's report
  3. Move to p=quarantine at a low pct= value (e.g. pct=10), not straight to full p=reject
Sample output
Week 4 (p=none)
  Alignment pass rate: 99.2%
  Unresolved senders: none
  Decision: move to p=quarantine at pct=10

Healthy

The rollout advances to p=quarantine at a small starting percentage, giving one more real-traffic checkpoint before scaling up.

Unhealthy

Jumping straight to p=reject at pct=100 the moment alignment crosses 99%, with no staged ramp to catch a sender that only sends mail occasionally.

What this means

A staged pct= ramp is the safety margin between 'the data looks clean' and 'enforcement is safe at full volume.'

So what do I do about it?

SymptomActionEffort
Alignment has been clean for a full week and the team wants to move to full enforcement immediatelyStart the ramp at pct=10 and hold another week before increasing it5 min
YouYou can do this yourself, no engineering access required.

Final deliverable

A completed 4-week rollout log showing the decision made at each checkpoint and the alignment pass rate that justified it.

See a reference example
Sample output
Mailchimp, DMARC rollout log (excerpt)

Week 1 (p=none): alignment 71%, 3 unresolved senders (billing tool, calendar invites, old CRM). Decision: hold, fix senders.
Week 3 (p=none): alignment 94%, 1 unresolved sender remaining (old CRM, being decommissioned). Decision: hold one more week.
Week 4 (p=none): alignment 99.2%, 0 unresolved senders. Decision: move to p=quarantine at pct=10.

Success criteria

You're done when you can:

  • Holds at p=none whenever any unresolved sender remains, regardless of how high the overall alignment percentage looks
  • Only recommends ramping enforcement once alignment is consistently above roughly 98% for a full week
  • Recognizes a rollback signal (a new unresolved sender appearing) as a reason to pause the ramp, not push through it