You moved to reject yesterday. This morning a team says their mail has stopped. The instinct is to revert immediately, and the correct first action takes about four minutes and makes the revert unnecessary surprisingly often.
Verify it is you
1. Get one failing message with headers. Not a description.
2. Read Authentication-Results.
dmarc=fail with your policy applied?
yes -> it is you. Continue.
no -> it is not the policy. Different problem,
and reverting will not fix it.
3. Which mechanism failed, and for which domain?
This names the sender and tells you whether the fix
is exemption or alignment.Step 2 rules out a meaningful share of reports. An enforcement change is a conspicuous recent event, so every unrelated mail problem that week gets attributed to it.
Four responses, in order of preference
| Response | When | Cost |
|---|---|---|
| Fix the alignment | The sender can be configured today — a custom return-path already available | Best outcome. Rarely available within the hour. |
| Exempt the stream with a subdomain policy | The failing mail comes from a subdomain | A p=none record at that name. The apex stays enforced. |
| Back off one step | The failing mail is on the apex and business-critical | reject to quarantine. Most protection retained, delivery restored. |
Revert to p=none | Widespread failure, cause unknown, and mail is business-critical | All protection gone. The last resort, not the first. |
Reverting to none is treated as the obvious move and is the worst of the four. It discards the entire programme’s protection to solve a problem that, in most cases, one subdomain record or one step back would have solved.
Afterwards
- Find out why the sender was not in the inventory. Four weeks of reports should have shown it. If it did not, the sender is seasonal, sends only to non-reporting receivers, or was added after the evidence window closed — and each of those changes how you plan the next domain.
- Do not re-enforce on the same evidence. The evidence was wrong once.
- Record what the criteria missed. This is the only way the go/no-go criteria improve.
A short TTL is what makes this recoverable
Every option above is a DNS change, and how fast it takes effect was decided days earlier. At a 300-second TTL you are restored in five minutes; at a day-long TTL you are explaining why the fix you applied at nine is still not working at four.