Rolling out DMARC gradually, after the end of pct

The real granularity was always the sources

Here's the point pct obscured: nobody really hardens "25% of a flow." Sources come into compliance, one by one. Real gradual rollout means walking the inventory — marketing platform, CRM, billing, support — and aligning each one (branded DKIM signature, d=example.com) until the reports show an aligned pass for all of them.

As long as legitimate sources fail, the policy stays at none (or quarantine if the risk is acceptable); once they're all aligned, hardening carries no false positive. That's the real graduality dial — far finer than a percentage, because it acts on the cause (an unaligned source) rather than a symptom (a failing volume). The source-by-source alignment method is detailed in getting to p=reject without breaking email.

The t=y test mode: the honest replacement for pct

DMARCbis introduces the t tag (for testing). Publishing t=y signals to receivers that the policy is under test: they apply the requested policy while knowing it isn't final yet, which nudges them to be more lenient and allows the effects to be observed without brutal consequences. It's the true modern equivalent of a cautious rollout: no longer "apply to 25%," but "here's the target policy, treat it as a test pending confirmation."

Concretely, t=y covers the window where the policy ramps and a net is still wanted. Once the reports are clean and confidence is established, t=y comes out (or goes to t=n) to make the policy fully effective. The tag's precise behavior is explained in the DMARCbis t tag.

The monitoring cadence between steps

A gradual rollout without monitoring isn't gradual, it's just slow. Each policy change deserves an explicit cadence:

• Day 1: a check that nothing broke immediately — no major legitimate source flipped to failure.
• Day 3: the first aggregate reports for the new step arrive (they're daily, with a lag). Alignment gets checked source by source.
• Day 7: a full week captures weekly variations (Monday campaigns, statements). If everything's clean, the next step is on the table.

This cadence turns "we hardened DMARC" from an optimistic bet into a controlled change, reversible at the first alert. These checkpoints need a named owner; a gradual rollout nobody watches is gradual in name only.

How long per step?

There's no universal duration, but a principle: each step lasts long enough to capture the full sending cycle. Where monthly statements go out, a few-day window won't see them — at least one billing cycle has to be observed before concluding "all clean." For a simple daily flow, a few days in quarantine suffice before reject. For a complex ecosystem, it runs to several weeks. The question of total duration is covered separately in the policy-ramp timeline.

Subdomains: a step not to forget

Gradual rollout isn't only about the root domain. Subdomains inherit p by default, but sp deserves explicit steering, and above all non-existent subdomains need locking down with np. Good news: np=reject is an immediate, risk-free win, to set early in the rollout — no legitimate mail leaves a subdomain that doesn't exist, so there's nothing to observe before hardening. Details in the subdomain policy (sp and np).

More than one domain? Staggering across the portfolio too

Across several domains, graduality has a third dimension: the order in which they're tackled. A secondary domain comes first — low volume, a simple sending flow — with the whole ladder run on it. The exercise teaches the team to read the reports, hold the monitoring cadence and execute the fallback move, all in a context where a mistake costs little. The proven playbook then replays on the flagship domain, where the stakes are real but the process is no longer new. Parked domains, meanwhile, need no graduality at all: nothing legitimate sends from them, so they can take the strictest policy on day one. Sequencing the portfolio this way turns a first rollout into a rehearsal instead of a gamble.

Knowing how to step back

A good gradual rollout includes a fallback plan. If a step reveals a missed legitimate source whose messages are blocked, the move is down a notch (say from reject to quarantine, or by re-enabling t=y), then aligning the source, then climbing back. Stepping back isn't a failure: it's exactly what graduality is meant to allow. The mistake would be staying at reject hoping the problem resolves itself while legitimate emails vanish.

Common pitfalls

• Still relying on pct. Some tools accept it for backward compatibility, others ignore it. It's no foundation for a rollout: DMARCbis removed it, and its behavior was uneven anyway.
• Skipping steps. Going straight from none to reject with no quarantine window works if and only if the reports have been spotless for weeks. In doubt, the airlock stays.
• Hardening without monitoring. A policy change with no checkpoint cadence is a bet, not a rollout.
• Forgetting to remove t=y. Test mode is a phase, not a destination: left in place, it weakens the target policy.

A sample timeline, from day one to reject

To make this concrete, here's what a calm progression looks like for a mid-size domain with no particular urgency:

• Weeks 1–3 — p=none. The record goes up with a rua address, np=reject set right away, and reports start flowing. Nothing is blocked. The source inventory takes shape and the obvious ones get aligned.
• Weeks 4–6 — alignment. The bulk of the calendar work. The inventory gets walked source by source, a branded DKIM signature added on each platform, and the reports confirm that each passes aligned. The policy stays at none while a major source still fails.
• Week 7 — p=quarantine; t=y. First enforcement step, in test mode. Monitoring follows the day 1 / 3 / 7 cadence. Test mode tells receivers the confirmation is still under way, and leaves a net.
• Week 8 — p=quarantine. t=y comes out. The quarantine policy is fully effective. A week of observation to capture a full weekly cycle.
• Week 9 — p=reject. Reports have been clean for several weeks, the only failing sources are unknown (thus impersonators). The policy hardens. The reports stay under watch, since a new unaligned source can always appear.

This timeline isn't a rule — a simple flow will go twice as fast, a complex ecosystem twice as slow. It's a template: each step is cleared on proof, not on a clock. The durations bend to the real sending cycle, never the other way around. And the temptation to compress it for a deadline is worth resisting: the one thing that reliably turns a gradual rollout into an incident is treating the calendar as the goal rather than the safety margin. When a manager asks why week 9 and not week 3, the answer is simple — because weeks 3 through 8 are what buy a week 9 with no bounced invoices.

In summary

The disappearance of pct didn't make DMARC rollout riskier — it made it more honest. Real graduality always rested on aligning the sources and on observation time between steps, not on a percentage receivers applied unevenly. The trio none → quarantine → reject, paced by serious monitoring and secured by the t=y test mode, remains the right method.

To situate a domain and check each source's real alignment before moving up a step, the free DMARC analyzer gives the verdict from the receivers' point of view: whether hardening will break anything — the single most useful signal to have in hand before the p tag moves again.