Introduction
For IT managers, DMARC is execution work. The strategy comes from elsewhere; the rollout is yours. This article is the practical checklist — week by week, deliverable by deliverable.
Why this topic matters
Most DMARC rollouts stall because the IT manager doesn't have a clear week-by-week plan. With one, the work is bounded and the path to enforcement is visible.
The week-by-week checklist
Week 1: Discovery
- [ ] DNS provider access confirmed.
- [ ] Current SPF, DKIM, DMARC state documented.
- [ ] Sender inventory from stakeholder interviews.
- [ ] DMARC platform selected.
Week 2: Foundation
- [ ] SPF cleaned up, under 10 lookups.
- [ ] DKIM enabled at primary sending platforms.
- [ ] DMARC published at
p=nonewithrua=. - [ ] TLS-RPT published.
Weeks 3-6: Monitoring + remediation
- [ ] Aggregate reports flowing to platform.
- [ ] Each sender row attributed.
- [ ] Failing senders remediated (custom DKIM, SPF updates).
- [ ] Pass rate ≥99% per known sender.
Weeks 7-10: Quarantine ramp
- [ ] Move to
p=quarantine pct=10. - [ ] Watch reports daily for first week.
- [ ] Ramp
pct=to 25, 50, 100. - [ ] Stabilize at
p=quarantine pct=100.
Weeks 11-12: Reject
- [ ] Move to
p=reject pct=100. - [ ] Confirm clean reports.
- [ ] Establish weekly review cadence.
- [ ] Document the runbook.
Ongoing: Steady state
- [ ] Weekly aggregate-report review.
- [ ] New-sender alerts triaged.
- [ ] Quarterly posture review.
- [ ] Annual DKIM rotation.
Step-by-step approach to running the checklist
- Calendar the milestones. Week 1 starts today.
- Assign supporting engineers. One owner, support team.
- Review weekly with management.
- Update the checklist as you discover client-specific complications.
- Document everything.
Best practices
- Don't skip discovery. Sender inventory is the foundation.
- Communicate with stakeholders. Marketing especially needs to know.
- Pair with common DMARC errors as troubleshooting reference.
- Use the safe rollout playbook for the policy moves.
- Renew the runbook annually.
Recommended next step
Pick week 1 start date. Put the milestones on the calendar. The checklist drives the rollout.
FAQ
Can I do this faster than 12 weeks?
For simple sender estates, 6-8 weeks is reasonable. Most mid-market takes 10-12.
What if remediation reveals senders I can't authenticate?
Subdomain isolation or migration. Handle third-party senders covers patterns.
What if my management wants faster?
Explain the risk of rushing. The phases exist to prevent incidents.
Should I delegate?
The execution can be delegated; the milestone ownership shouldn't.
How do I report progress?
Weekly status email plus a milestone calendar. Clear, brief.
Final thoughts
For IT managers, DMARC is a 12-week project with a clear deliverable: domain at p=reject. The checklist above is the structure.
Run the weeks; hit the milestones; document the runbook. The steady state is the durable outcome.