DMARC enforcement readiness
Prepared by Example MSP for Example Clinic
Domains: example.com, example.net, lists.example.net
Prepared on 2026-10-01
Senders
| Domain | Source | Provider | Messages, 30 days | SPF | DKIM | Owner | Approved | Action |
|---|---|---|---|---|---|---|---|---|
| example.com | Staff mailboxes | Microsoft 365 | 18,420 | Pass | Pass | IT lead | Yes | None |
| example.com | Patient reminders | Practice management system | 6,210 | Pass | Fail | Practice manager | Yes | Custom DKIM key requested from the vendor |
| example.com | Newsletter | Mailchimp | 2,900 | Pass | Pass | Marketing lead | Yes | None |
| example.net | Invoices | QuickBooks Online | 410 | Pass | Pass | Office manager | Yes | None |
| example.net | Unknown host, AS64500 | Not identified | 37 | Fail | Fail | Not claimed | No | No owner after two requests; treated as unauthorized |
| lists.example.net | Staff posting to an industry list | External mailing list | 120 | Fail | Fail | IT lead | Yes | Documented exception, see below |
Readiness checklist
| Item | Status | Evidence |
|---|---|---|
| DMARC record published with aggregate reporting | Done | Reports received daily since 2026-08-04 |
| At least 30 days of aggregate reports reviewed | Done | 58 days of reports from 14 receivers |
| Every sending source identified | Done | 6 sources, listed above |
| Every source has a named owner or is marked unauthorized | Done | 5 owners named, 1 source unclaimed |
| The client approved each legitimate source | Done | Approved by the practice manager on 2026-09-22 |
| SPF aligned for every approved source | Done | Aligned in the last 14 days of reports |
| DKIM aligned for every approved source | Open | Patient reminders still sign with the vendor's domain |
| Mailing-list traffic assessed | Exception | lists.example.net stays below reject, see exceptions |
Documented exceptions
lists.example.net
Staff post to an external mailing list that rewrites messages, so their mail fails DMARC at the list's recipients. Under reject, those recipients would refuse it.
Policy held at p=quarantine · RFC 9989 section 7.4
DNS changes
| Date | Record | Change | Reviewed by |
|---|---|---|---|
| 2026-09-12 | SPF | Added the newsletter platform's include to example.com | Service desk lead, approved by the IT lead |
| 2026-09-26 | DMARC | example.net moved from p=none to p=quarantine after sign-off | Service desk lead, approved by the practice manager |
Sign-off
Client owner
Practice manager, Example Clinic
Approved on
Awaiting sign-off
Signature