Sequencing an estate

An estate is rarely uniform and never has uniform attention available. Sequencing badly means spending the first quarter on the hardest domain and arriving at the easy wins with no credibility left.

Split by population first

Population	Typical share	Work required
Sends nothing, and never will	Most of the estate	Four records, generated. An afternoon for all of them.
Sends a little, from one or two known systems	A handful	Align the senders, then enforce. A week each.
The primary sending domain	One, occasionally two	The whole programme. A quarter, realistically.
Acquired or inherited, posture unknown	Variable	Observe for a month before classifying at all.

The first row is the point of the exercise. Most estates are mostly parked domains, and the strict non-sending set takes them from completely unprotected to fully protected with no risk and no negotiation with anyone.

The order

Week 1    rua on EVERY domain, including parked ones.
          Costs nothing, breaks nothing, and starts the
          clock on the evidence everything else needs.

Week 1    the non-sending set on domains you are certain
          about. Most of the estate protected immediately.

Weeks 2-6 read reports. Reclassify anything that turns out
          to send. Align the senders on the small domains.

Weeks 6+  the primary domain, evidence-driven, one policy
          step at a time.

Ongoing   acquired domains enter at "observe for a month".

Why this order

Decision	Reason
Reporting before anything else	Every later decision is evidence-driven, and evidence takes weeks to accumulate. Starting the clock is free.
Parked domains before the primary	Largest risk reduction per hour spent, and no dependency on anybody outside the team.
Small senders before the primary	They build the alignment playbook on low-stakes mail before it is applied to mail that matters.
The primary last	It has the most senders, the most stakeholders and the least tolerance for a mistake.

The primary domain is not where to learn

The instinct is to start with the domain that matters most. It is also the domain with fifteen unidentified senders, four teams with opinions and the highest cost of getting it wrong. Arrive there having already aligned a vendor, read a quarter of reports and rehearsed a rollback somewhere it did not matter.

Knowledge check

An estate has one primary domain and forty parked ones, none with DMARC. Where does week one go?

rua on all forty-one, and the strict non-sending set on the parked domains you are certain about.
The primary domain, since it carries the mail that matters.
An inventory of every sender on the primary domain, by interview.
p=reject on the parked domains only, skipping the reporting.

Correct — rua on all forty-one, and the strict non-sending set on the parked domains you are certain about. It is the largest risk reduction available per hour, it depends on nobody outside the team, and publishing rua everywhere starts accumulating the evidence that every later decision on the primary domain will need.

Not this — The primary domain, since it carries the mail that matters. It also carries the most unknown senders and the least tolerance for error. Forty unprotected domains carrying your brand are a live exposure you can close this week.

Not this — An inventory of every sender on the primary domain, by interview. Interviews miss anything set up by someone who has left. Publishing rua and reading a month of reports is both cheaper and more complete.

Not this — p=reject on the parked domains only, skipping the reporting. Close — and without rua you will not learn that one of them is running a contact form nobody remembers, which is exactly the thing the fortnight of observation catches.

Split by population first

The order

Why this order

Try it on a real domain