Advanced Email Trust — assessment

Sample question

A policy reads mode: enforce, mx: mail1.example.com, max_age: 604800. You add mail2.example.com to both the policy and the MX record today. What happens?

• Enforcing senders holding the previous policy refuse mail2 for up to seven days, because their cached copy does not list it.max_age is a commitment rather than a hint. The policy change has to lead the MX change by at least that long — senders holding a valid cached policy are under no obligation to refetch before it expires.
• Nothing — both were changed together, so they stay consistent.They are consistent in your zone and on your web server. The copy that decides the outcome is the one each sender cached earlier.
• Senders refetch immediately because the policy file changed.Senders detect a change via the id in the TXT record, and only when they next check — which for a valid cached policy may be days away.
• mail2 works for senders in testing mode and fails for the rest.Mode is set by your policy, not chosen per sender. Every enforcing sender applies the cached policy it holds.

Every option carries an explanation, including the wrong ones.