Move DMARC from monitoring to enforcement with explicit release gates

Define the decision

Time spent at p=none is not a sufficient release criterion. Rare but important payroll, support or password-reset mail can be absent from a short sample. Require a sender inventory and an accountable owner for each stream.

Work through the procedure

1. List routine and infrequent legitimate senders.
2. Correct known alignment failures and test important indirect routes.
3. Define which evidence permits enforcement and which failure requires rollback.
4. Apply an approved policy change during a monitored window, then inspect both reports and support signals.

Worked example

The following is a synthetic example for this procedure, not a customer result or performance benchmark.

Gate: every inventoried stream has a recent verified sample
Unresolved: monthly statement sender not yet tested
Decision: postpone enforcement until the statement path is checked
Rollback owner: domain administrator, with prior record preserved

Read the result

A gate-based rollout connects DNS changes to business continuity. It also makes the reason for waiting explicit, instead of repeatedly extending an arbitrary monitoring period.

Check before moving on

1. Retain the old policy and change timestamp.
2. Confirm that report ingestion still works after the change.

Limits and next action

The 2026 DMARC specification removes the legacy pct tag. Do not promise percentage-based enforcement from an older tutorial; verify current provider behavior and supported controls.

Source: RFC 9989: DMARC policy transition context