Introduction
Growing companies accumulate domains. Primary brand, regional variants, M&A acquisitions, defensive registrations, retired brands still receiving mail. Each is a potential spoofing target. Managing DMARC across multiple domains is its own discipline.
This article covers the patterns that work.
Why this topic matters
Each unprotected domain is an attack vector. A typical mid-market growth-stage company has 5-15 domains; an enterprise has 50-500. Each one needs its own DMARC posture.
The three categories of domain
1. Active sending domains
Domains actively used for mail. Standard rollout to p=reject.
2. Active receiving-only domains
Receive mail but don't send. Publish v=DMARC1; p=reject; sp=reject — there's nothing to break.
3. Defensive / parked domains
Registered to protect the brand but don't send or receive meaningfully. Publish v=DMARC1; p=reject; sp=reject — eliminates the spoofing vector.
The vast majority of corporate domains fall in categories 2 and 3. Each gets a simple "reject everything" DMARC record.
Step-by-step approach
- Inventory all domains. Often more than expected.
- Categorize each. Active sending, active receiving, defensive.
- Publish DMARC at
p=rejectfor all categories 2 and 3 immediately. - Roll out category 1 domains through the standard playbook.
- Centralize monitoring under one DMARC platform.
Best practices
- Default deny by default. Defensive domains should be at
p=rejectimmediately. - Centralize reporting. Same
rua=mailbox across the portfolio. - Document the inventory. New M&A activity adds domains.
- Pair with subdomain strategy. Both layers matter.
- Quarterly review. Domain estate changes.
Recommended next step
Pull a list of every domain your company owns. For each in category 2 or 3, publish p=reject this week. Category 1 follows the standard rollout.
FAQ
Why publish DMARC on a non-sending domain?
Without it, attackers can still spoof. With p=reject, the spoofing vector is closed.
What about retired brand domains?
Same answer. Publish p=reject until the domain is fully decommissioned.
Do we need DMARC reports from defensive domains?
Yes — they catch spoofing attempts against parked brands.
How do we handle M&A?
Acquired domains get the rollout. Add to the playbook.
What about regional variants?
Each is a separate domain; each gets its own DMARC. Pattern repeats.
Final thoughts
Multi-domain DMARC is portfolio management. Most domains can be "set and forget" at p=reject; active sending domains warrant the rollout.
Inventory once; protect everything; renew quarterly. The work compresses fast at scale.