On this page
Once reports are arriving, the work is a loop: find out who is sending as your domain, fix the senders that are yours, and raise the policy one step at a time. Here is what a typical first month looks like.
Week one: find out who is sending as you
The DMARC page lists every source that sent mail as your domain. Where we recognise the provider, we name it: Google Workspace, Microsoft 365, a newsletter tool, your CRM.
Where we don’t, we name the network that owns the address. Senders sit in three sections:
- Needs review: nobody has said whose these are yet. It is the only section that asks you for a decision.
- Yours: services you use. These are the ones that must pass before you enforce.
- Not yours, and relayed mail: senders you marked as not yours, plus your own mail forwarded or sent through a mailing list by someone else.
Marking a sender takes one click, and you can change your mind later.
Most of week one is working through “Needs review” with whoever knows which tools the company uses.
Week two: fix the senders that fail
A sender of yours that fails gets a fix that matches how it failed, not a generic checklist.
| How it fails | What the card offers |
|---|---|
| The service is missing from your SPF record | Add to your SPF. One click when your SPF is hosted with us (Business and above); otherwise, the exact include: to paste into your own record. |
| SPF passes, but on the provider’s own domain (common with marketing tools) | No SPF change can make it align. The card says so and points you to the provider’s custom return-path setting instead. |
| DKIM is not signing as your domain | Enable DKIM in that provider’s settings and publish the record it gives you at <selector>._domainkey. |
Say someone signed up for a tool without telling anyone. When that unrecognised sender starts sending real volume as your domain, you get an email about it.
Week three: take the first step up
Your policy moves along fixed steps:
- Monitor: failing mail is still delivered
- Quarantine 25%: the rest are still delivered
- Quarantine 50%: the rest are still delivered
- Quarantine: failing mail goes to spam
- Reject 25%: the rest go to spam
- Reject: failing mail is refused
The percentage is the share of failing mail the policy applies to. The rest falls back one level, so at “Reject 25%” a quarter of failing mail is refused and the rest goes to spam.
What the readiness check asks for
The DMARC page shows one recommended next step, and only when your own reports support it. All of these must hold:
- 14 days of reports, with data on at least 10 of them.
- At least 100 messages from senders we can identify.
- A pass rate among those senders of 98% for quarantine, or 99.8% for reject.
- No sender of yours failing.
- No new high-volume sender without a track record.
When something stands in the way, the card names it. The enforcement ladder in the docs explains each step.
What you see before you approve
Before you approve a step, an impact preview lists the senders it would hurt. Nothing moves your policy on a schedule.
If you need to move despite a blocker, you can, but only after the blockers have been shown to you. That choice is recorded in the policy history.
Week four: climb the ladder
Each enforcing step is held for at least 3 days before the next is offered, so its effect shows in the reports first.
At that pace, the earliest a domain can go from its first reports to full reject is about 26 days. Many take longer, and that is fine.
If a step hurts
Stepping back is never blocked. Every change is kept in the history, and a rollback publishes the exact record you had before rather than an approximation of it.
A daily check compares each of your senders’ pass rates before and after a change. If one of them starts failing, it emails you with a link to step back.
Your subdomains
On newly added domains, subdomains follow your policy at each step (the record carries no sp= tag). The readiness check looks at their mail first.
What the alerts and the Monday digest tell you
Alerts arrive by email when something needs you:
- Reports stopped arriving.
- A hosted record disappeared from your DNS.
- A new unknown sender.
- A drop in pass rate.
- Mail failing after a policy change.
- An MTA-STS certificate close to expiry.
- Monthly volume nearing its limit.
They go to the workspace owner and admins, and each person can switch individual alert types off. The same alert for the same domain is emailed at most once a day. Alerts in the docs lists each one.
On Monday mornings, a digest summarises the previous week: reports received, messages, pass rate, new senders, alerts raised, and each domain’s grade, worst first.
On a quiet week, that email is how you know everything is still running.
Let your own reports show you the month ahead. Or scan your domain to see its records today.
