The DMARC enforcement ladder

Your DMARC policy tells receivers what to do with mail that fails authentication while claiming to be from your domain. SentraDMARC moves it along fixed rungs, one step at a time, and checks your reports before each step up.

The rungs

pct is a sampling rate: each failing message is subject to the policy with that probability. Mail outside the percentage falls back one level (RFC 7489 §6.6.4), which is why Reject 25% sends the rest to spam rather than delivering it. Every domain starts at Monitor.

When a step up is allowed

The same rule decides what the page recommends and what the server accepts. It looks at the last 14 days of reports, by the date the mail was sent:

• at least 10 days with reports, and at least 100 messages from your identified senders;
• your identified senders' mail passes DMARC at 98% or more to move to quarantine, 99.8% or more to move to reject, whatever the percentage;
• no identified sender failing: one with 10 or more failing messages in the window and a pass rate under that bar blocks the step, and the page names it;
• no new high-volume sender: an identified sender first seen in the last 72 hours with 100 or more messages has no track record yet;
• 3 days on the current rung before the next one, so each step's effect shows in the reports before you build on it.

"Identified" means a sender matched to a known provider that you have not marked as not yours, or any source you marked as yours. Unrecognised addresses failing DMARC are left out on purpose: that mail is what enforcement exists to stop.

One recommended next step

The enforcement rail on the DMARC page shows where you are and one recommendation: "Move to Quarantine 25%", "Not yet" with the first thing in the way and a button to fix that sender, or "Hold on this rung until" a date.

The impact preview

Before a change is published, a preview lists your senders that would be affected, by name and volume: "Mailchimp (1,240 messages) would go to spam." Below 100% it says roughly how many, and what happens to the rest. It also counts the unrecognised sources whose mail the change would stop.

If the domain is not ready, the preview says why. You can still go ahead by ticking "I understand this, and want receivers to…" and pressing Enforce anyway. The override is recorded in your policy history.

Stepping back

Step back is always available and never gated: a rollback that can be refused is not one. It publishes the rung below the one you are on.

Policy history

Policy history lists every change: the ones made here, overrides, and changes seen in your DNS that were made elsewhere. Revert to this republishes the earlier record exactly as it was. A revert that raises enforcement is checked like any other step up.

If you publish your own _dmarc record

If your DMARC record is a TXT you manage at your DNS host, the rail runs the same readiness check and impact preview, then gives you the record to publish. It starts from your live record and changes only p=, pct= and sp=, keeping every other tag. Replace your TXT at _dmarc with it and press "I have published it, check now". The change appears in your history once we read it from your DNS.

After a step: the watch

For 14 days after a change, a daily job compares each identified sender's pass rate before and after it. If one drops by more than 2 points (senders with 50 or more messages), or a sender appears with 10 or more failing messages, you get an alert, "Mail failing since the DMARC change", that links straight to Step back. At most one per domain every 72 hours.

Subdomains

Your policy can apply to subdomains as well. See Subdomain policy.