A policy change is one TXT record, so a rollback is also one TXT record — in theory. In practice the time to revert is dominated by two things decided days earlier: the TTL, and whether anyone has agreed in advance what would justify reverting.
Lower the TTL first
A resolver holds the record for the TTL it was given when it fetched it, so lowering the TTL at the moment of the change helps the change after this one. Lower it a full current-TTL period before you touch p.
T-48h TTL 86400 -> 300 T-24h confirm short TTL is being served everywhere T-0 change p T+72h if stable, restore the TTL
With a 300-second TTL a rollback is effective in five minutes. With a day-long TTL it is effective tomorrow, and the difference is entirely decided before the change.
Agree the triggers in advance
| Signal | Action |
|---|---|
| A business-critical stream stops arriving | Revert immediately. Diagnose afterwards. |
| Aligned pass rate falls more than 2 points | Investigate; revert if the cause is not identified within a day. |
| A named sender starts failing | Exempt it with its own subdomain policy, or revert. |
| Complaints with no measurable change in reports | Do not revert. Reports lag by a day; verify before acting. |
The last row matters. The first day at enforcement produces complaints about everything unrelated that happened to go wrong that week, and reverting on anecdote teaches an organisation that the policy is fragile.
Prefer a partial revert
- Back off one step, not to none.
rejecttoquarantinekeeps most of the protection and restores deliverability for whatever broke. - Exempt rather than revert, where you can. A failing stream on its own subdomain can be given
p=noneat that name while the apex stays enforced. - Reverting
spalone is often enough, and leaves the apex protected.
Rehearse it once
Make the change to p and put it back, at none, before any of it matters. It confirms who has access to the zone, how long the change takes to propagate, and whether the process anyone wrote down is the process that actually exists. The first time you do this should not be during an incident.