Choosing Enforcement Without Breaking the System

This chapter turns the authentication and feedback model into a policy decision: when should a domain remain in monitoring, move to quarantine, or request rejection of failing mail? The focus is not on choosing the strongest-looking tag, but on deciding whether the organization understands its legitimate streams, indirect paths, reporting limits, and repair capacity. By the end, you should be able to identify the evidence that should precede a policy change and recognize the security, privacy, and interoperability costs that a stronger setting can create.

Enforcement is often described as a switch. In practice, it is a transition between states in a distributed system. The domain owner changes a DNS record, but receivers discover that record at different times and apply it within their own local policies. Vendors and internal teams may still be sending. Forwarders and mailing lists may still be transforming messages. Reports may expose only part of the result. A policy change can therefore improve protection against spoofing while also making a previously tolerated legitimate path fail.

The sound question is not “Can this domain publish reject?” It is “What does the domain know, what remains unexplained, and which consequences can it detect and reverse?”

stateDiagram-v2 [*] --> MONITOR MONITOR: Monitoring with p=none and aggregate reports MONITOR --> REPAIR: Legitimate gap or unknown stream found REPAIR: Fix list, DNS, vendor, or authentication condition REPAIR --> MONITOR: Observe the repaired stream MONITOR --> QUARANTINE: Evidence supports an intermediate control QUARANTINE: Treat failing mail as suspicious QUARANTINE --> REPAIR: Feedback reveals legitimate harm QUARANTINE --> ENFORCE: Legitimate and indirect flows understood ENFORCE: Request reject for failing domain use ENFORCE --> REPAIR: Reports or returns reveal breakage MONITOR --> HOLD: Evidence or safeguards are unavailable QUARANTINE --> HOLD: Privacy or processing risk appears ENFORCE --> HOLD: Reassess receiver and reporting impact HOLD --> MONITOR: Restore evidence and observe again

The diagram treats enforcement as a lifecycle because each state has a different purpose. Monitoring is not simply “doing nothing.” Quarantine is not just a weaker reject. Rejection is not a final proof that the system is healthy. The transitions are triggered by evidence about mail streams and by the organization's ability to respond when that evidence changes.

Enforcement Begins with Evidence, Not a Tag

A domain owner preparing for DMARC needs two kinds of readiness. The first is technical: legitimate mail should produce at least one aligned authenticated identifier, preferably through both SPF and DKIM. The second is observational: the owner should receive and analyze aggregate reports well enough to know which sources use the Author Domain and which of those sources fail or pass. Publishing a policy without the ability to see its consequences turns enforcement into a blind intervention.

RFC 9989 describes a sensible starting point. The owner establishes aligned SPF and DKIM, creates a place to receive aggregate reports, and publishes a DMARC policy—usually beginning with p=none and a rua destination. In this monitoring state, the receiver can validate messages and report what it saw, while the policy does not change existing mail handling. The owner uses the reports to find overlooked servers, third-party agreements, unaligned identities, and apparent abuse.

The quality of the decision depends on what the owner does with those reports. A source that fails DMARC may be a spoofing attempt, but it may also be a legitimate billing service, support tool, or decentralized department. The owner needs to connect the reported source and identifiers to an accountable person or vendor. If the stream is legitimate, the next action is remediation: align its SPF MAIL FROM or DKIM signing domain, correct a missing signature, repair a DNS record, or change the sender's operating process. If the stream is unauthorized, the evidence can support a stronger case for enforcement, but the owner should still understand its volume and possible effects.

The waiting period cannot be a universal number.