skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-dmarc-policy-enforcement-rollout

Execute a phased DMARC rollout from p=none monitoring to p=reject enforcement.

954|172|Updated Mar 13, 2026
Search Tags:#dns#spf#dkim#dmarc#anti-spoofing#email security#phishing defense
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-dmarc-policy-enforcement-rollout
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-dmarc-policy-enforcement-rollout
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/phishing-defense/performing-dmarc-policy-enforcement-rollout
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-dmarc-policy-enforcement-rollout

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Organizations that enable DMARC too aggressively block legitimate email, while those stuck at p=none get reports but no anti-spoofing protection. This Skill provides a safe, phased rollout methodology that authenticates every legitimate sending source before enforcement.

Core Features & Use Cases

  • Phased Policy Progression: Move from p=none through p=quarantine to p=reject using gradual pct ramps (10% to 100%) with report review between steps.
  • SPF/DKIM Alignment Guidance: Inventory sending sources, keep SPF under the 10-lookup limit, and configure DKIM signing for third-party platforms like Mailchimp, SendGrid, and Zendesk.
  • Misconfiguration Detection: Identify common failures such as alignment mismatches, missing subdomain policies, and absent rollback plans.
  • Use Case: A security team needs to meet Google and Yahoo bulk sender requirements. Follow the 3-6 month workflow to publish DMARC records, analyze aggregate reports with tools like EasyDMARC or dmarcian, and reach full p=reject without blocking legitimate mail.

Quick Start

Guide me through a phased DMARC rollout for our domain, starting from p=none monitoring and ending at full p=reject enforcement with subdomain protection.

Frequently Asked Questions about performing-dmarc-policy-enforcement-rollout

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I roll out DMARC from p=none to p=reject safely?▼

Start with p=none to collect aggregate reports for 1-2 weeks, fix SPF and DKIM alignment for all legitimate sources, then move to p=quarantine and p=reject using gradual pct increases of 10, 25, 50, and 100 percent with report review between each step.

How long does a DMARC enforcement rollout take?▼

A safe DMARC rollout typically takes 3-6 months. This includes source inventory, SPF and DKIM configuration, monitoring at p=none, and gradual pct ramps through quarantine and reject with 1-2 weeks of report analysis between increases.

Why does legitimate email fail DMARC even when SPF passes?▼

A source can pass SPF or DKIM yet fail DMARC because the authenticated domain does not align with the From header domain. Check alignment in aggregate reports rather than just authentication pass results, and verify adkim and aspf alignment modes.

What tools can I use to analyze DMARC aggregate reports?▼

DMARC aggregate reports can be analyzed with EasyDMARC, DMARCLY, dmarcian, or Valimail, which parse the daily XML reports into dashboards. MX Toolbox and Google Admin Toolbox provide DNS record validation and DMARC record checks.

What happens if I skip the pct tag and jump straight to p=reject?▼

Jumping directly to p=reject blocks legitimate sending sources that are not yet aligned, such as unsigned marketing or ticketing platforms. Use pct to apply the policy to a small percentage of mail first, and keep an emergency rollback to quarantine ready.

Related Skills

Explore More Software Engineering Skills→
GoldenWing-360GoldenWing-360
15

email-deliverability-security

Configure SPF, DKIM, DMARC, and related DNS records for email authentication.

Official
Intermediate
GhostPWNGhostPWN
4

Incident Response & Digital Forensics

Create PICERL-aligned incident response playbooks and forensic workflows.

Official
Advanced
blamejsblamejs

email-security-anti-phishing

Audit email authentication protocols and map phishing TTPs to compliance framework gaps.

Official
Advanced
L3DigitalNetL3DigitalNet
6

bind-utils

Query DNS records and diagnose resolution issues with dig, nslookup, and host.

Official
Intermediate