DMARC has no equivalent of SPF’s redirect=. Every domain needs its own record at its own _dmarc name, so an estate of fifty domains is fifty records that will drift apart unless something stops them.
What drift looks like
Nobody sets out to have inconsistent policy. It arrives one exception at a time: a domain moved to none during an incident and never moved back, a newly acquired domain that was never onboarded, a record someone edited by hand and mistyped.
brand-a.com p=reject rua -> processor brand-b.com p=reject rua -> processor brand-c.com p=none rua -> processor <- reverted in March brand-d.com p=reject (no rua) <- typo, no visibility brand-e.com (no record) <- acquired in June
Only the first two are doing what the organisation believes all five are doing, and nothing in any individual record reveals the problem. It is visible only in a view across the estate.
Three approaches
| Consistency | Cost | |
|---|---|---|
| Manual, per domain | None. Drift is guaranteed at any scale. | Low until it is not. |
| Generated from a source of truth | Strong — the zone is output, not input. | Requires DNS-as-code, which is worth having anyway. |
Delegated _dmarc CNAMEs to a processor | Strong — one place to change, applied everywhere. | The processor now controls your enforcement. |
Generation is the better answer where you can have it: the policy lives in a file, the file is reviewed, and the records are what the file says. Delegation achieves similar consistency by handing the decision to someone else, which is a reasonable trade for a large estate and a poor one for two important domains.
Keep the reporting separable
- A shared
ruaaddress is fine — reports identify their own domain, so a single destination does not blur them. - Each external destination still needs an authorisation record per source domain. Adding a domain to the estate means adding its
_report._dmarcentry too, or that domain reports nothing. - Audit the set, not the records. The useful check is “list every domain and its policy”, run on a schedule. Checking one record at a time never finds the one nobody thought to check.
Non-sending domains should be the large majority
Most estates have a handful of domains that send and dozens that exist defensively. The defensive ones take the same four strict records every time and can be generated wholesale. Separating the two populations first makes the remaining work much smaller than it looked.