Ninety days, and a year — Domain Security Practitioner

Everything past day thirty needs either evidence that is still accumulating or somebody else’s cooperation. The plan has to be sequenced around those constraints rather than around what would be satisfying to do first.

Days 31 to 90

Work	Gated on	Runs in parallel with
Build the sender inventory from aggregate reports	Elapsed time. Four weeks minimum.	Everything else in this row set
Ask every platform owner: can this align, on our current plan?	Internal owners, then vendors	The inventory
Align the senders that can align today	Each vendor separately	Each other
Move the primary to `p=quarantine`	The inventory being complete and the pass rate above 95%	—
Recover the .de and .co.uk domains	A registrar process, measured in months	Everything. Give it its own track.
Lock down the two parked domains with MX	A fortnight of reports showing nothing reads that mail	—
Stand up monitoring for the five-domain campaign and its successors	Nothing. Available now.	—

Days 91 to 365

Quarter 2
   p=reject on the primary, once quarantine has held
   for four weeks with the pass rate above 98%.
   MTA-STS in testing, then enforce, using TLS-RPT.
   Registry lock on the primary and the payments domain.

Quarter 3
   The vendor that cannot align today: revisit at the
   renewal, with the constraint already documented.
   DNSSEC on the primary IF the provider offers managed
   signing with CDS — otherwise it stays on the
   not-doing list.

Quarter 4
   Quarterly sweeps are routine by now: selectors,
   dangling records, lookalike queue, lock state.
   Handover documentation complete and tested.
   Reassess the estate against the same method and
   compare.

The three constraints that shape this

Constraint	Cannot be removed by	So
Four weeks of reports before quarantine	Any amount of effort or money	Start it on day one. It runs while everything else does.
One vendor gated behind a contract renewal	You	Contain that stream on a subdomain rather than holding the apex.
A registrar recovery process	You	Its own track, its own owner, not on the critical path.

Name the dates that are not yours

A plan that presents the vendor renewal and the registrar process as your deliverables will be measured against them and miss. Presenting them as external dependencies with named owners converts a missed date into somebody else’s decision, which is both accurate and considerably easier to escalate.

Knowledge check

A vendor cannot support alignment until a contract renewal in month eight. What does that do to the plan?

Nothing to the apex timeline — move that stream to its own subdomain with a weaker policy, and keep the renewal as a documented external dependency.
The primary domain stays at p=none until month eight.
Use pct to enforce partially until they align.
Add their IPs to SPF and accept the unaligned pass.

Correct — Nothing to the apex timeline — move that stream to its own subdomain with a weaker policy, and keep the renewal as a documented external dependency. Containing the exception at one name stops a single vendor determining the end date for the whole estate, and the documented constraint becomes a procurement input rather than your missed deadline.

Not this — The primary domain stays at p=none until month eight. That lets one vendor hold the entire estate open when one subdomain record removes the dependency.

Not this — Use pct to enforce partially until they align. It randomises which of that platform’s mail is lost and makes the reports harder to read.

Not this — Add their IPs to SPF and accept the unaligned pass. An unaligned pass contributes nothing to DMARC. The mail fails either way.