What you’ll be able to do
- Inventory who sends as a synthetic domain before changing a handling preference.
- Publish p=none with an rua address and say what aggregate reports are for.
- Explain why silence after p=none is not enforcement, and why forwarding can break SPF more often than aligned DKIM.
- Refuse a jump to p=reject on a domain whose reports have not been read.
Inventory who sends as the domain
Riverstone’s synthetic mail domain for this exercise is quayside.example, operated as Quayside Mail. It is not a customer domain and not a place to paste an employer’s records. This lesson is an elective. Beginners can stop after the mailbox lesson. You do not need this page to finish Foundations.
Maya’s first move is an inventory, not a slogan. List who sends as quayside.example: the finance app, the payroll vendor, the customer-notice tool. Publish SPF for those hosts. Sign with DKIM aligned to the Author Domain. A policy with no inventory is a guess about mail you have not seen.
p=none, then read the reports
Publish a DMARC record at _dmarc.quayside.example with v=DMARC1, p=none, and rua=mailto:dmarc-reports@quayside.example. p=none means the domain offers no handling preference. That is monitoring when the reports actually arrive. Read them. Fix legitimate streams that fail alignment. Publishing a record and never opening the reports is not the control.
Start here so missed servers and third-party senders show up before mail is rejected. Silence after the record is published is not a move to quarantine or reject, and it is not a renewal of anything. The reports are the record that the monitoring ran.
Forwarding, then enforcement
Only after the reports look clean should you consider p=quarantine or p=reject. p=quarantine means the owner considers the failure suspicious. p=reject means the owner considers that use of the name not valid. Receivers may still apply their own judgment.
When you enforce, keep aligned DKIM in place. Forwarding breaks SPF more often than it breaks a signature that still verifies. Domains whose people post to mailing lists should not jump to p=reject. p=reject on quayside.example does not stop a cousin domain, and it does not make a passed message safe to pay.
CHECK YOUR JUDGMENT