Multi-brand, multi-domain: DMARC governance at scale

example.net.          MX    0 .
example.net.          TXT   "v=spf1 -all"
_dmarc.example.net.   TXT   "v=DMARC1; p=reject; sp=reject; np=reject; rua=mailto:reports@example.com"

The organizational foundation: a registry, owners, a process

The centerpiece of the governance is not a DNS record; it is a central domain registry. For each entry: the name, its category in the typology, the registrar, the DNS zone that hosts it, the current policy, the target policy, the list of authorized sending vendors, and the date of the last review. The tool matters little — a spreadsheet is enough to start — as long as it is unique, current and authoritative: what is not in the registry does not officially exist, and what exists without being in the registry is an anomaly to be dealt with.

Second pillar: a named owner per domain. A person, not "the marketing team" — teams get reorganized, people answer email. The owner is who approves a reactivation, confirms a vendor is still under contract, and answers within twenty-four hours the question "is this source legitimate?" when an unknown IP shows up in the reports.

Third pillar: the "new sending tool" process. Nobody — not a brand, not an agency, not a subsidiary in a hurry — wires up an email platform without going through the registry. The sequence is short: declare the tool, publish the DKIM keys and the SPF include, test alignment on a sample, record the entry in the registry, and only then send real traffic. Mailchimp, Brevo and SendGrid all document DKIM delegation: the step costs a few days when anticipated, and weeks of false positives when discovered after the fact. This process is the only durable answer to marketing shadow IT.

The registry also lives at the pace of the fleet: a merger or acquisition brings in domains by the dozen, with their history and their surprises; a poorly tracked expiration hands a brand name to the first taker; a reactivation without a procedure reopens a door that had been carefully locked. Every lifecycle event goes through the registry, or the governance decays back into dead documentation.

Industrializing DNS: centralized zones, controlled delegation

A governance that rests on two hundred manual changes across five different registrars will not survive its second year. Industrialization starts with zone centralization: one primary DNS host, changes managed as code (infrastructure as code, peer review, a change log), and an end to registrar credentials scattered across the brands.

Centralization does not forbid autonomy: controlled delegation leaves the brands in charge of their web presence — delegated subdomains, the A and CNAME records of their sites — while the authentication records (_dmarc, DKIM selectors, SPF includes) stay in the group's control zone. The boundary is clean: the web gets delegated, the sender identity does not.

The most powerful tool of the lot is the CNAME to a control zone. Instead of publishing two hundred individual policies, each _dmarc points to a small set of standard policies maintained in one place:

_dmarc.example.net.         CNAME  locked._dmarc.example.com.
locked._dmarc.example.com.  TXT    "v=DMARC1; p=reject; sp=reject; np=reject; rua=mailto:reports@example.com"

Changing the report collection address, or hardening a whole class of domains at once, becomes a single edit in a single zone. The mechanism is already familiar from vendor DKIM keys (a CNAME into the ESP's zone); extending it to DMARC policies is its logical continuation, and it is what makes a two-hundred-domain fleet steerable by a small team.

The p=reject trajectory: in waves, never as a big bang

Hardening two hundred domains at once guarantees an incident; hardening them one by one, in no particular order, guarantees never finishing. The sane trajectory proceeds in waves, each small enough to be watched closely and representative enough to move the method forward.

• Pilot wave. Two or three sending domains with moderate stakes, carried by a willing team. The goal is not the volume protected; it is the shakedown: the tooling, the reports, the decision loop with the owners.
• Main brands. The highest spoofing value, but also the most vendors and therefore the longest remediation. The method proven in the pilot applies domain by domain, with the "new tool" process already in force so that sand stops pouring in while the sea is being emptied.
• Long tail. The remaining small sending domains, handled in series with a checklist that has been tested by then.

In parallel, and from day one, the defensive and parked domains go straight to lockdown — there is no reason to wait. Each wave follows the same cycle: p=none and observation, alignment fixes, test mode declared with the t=y tag (which replaces the old gradual ramp through pct), then p=reject. The cycle is short on a clean domain and long on one loaded with history; the wave absorbs that variance, not the overall calendar.

The steering indicators

A multi-year program without indicators dies at the first change of priorities. A few measures are enough, provided they are tracked regularly.

• The share of the fleet at p=reject — the lead indicator, readable by an executive committee without a single line of technical explanation. Its quarterly progression tells the whole story of the program.
• Registry coverage: the gap between declared domains and discovered domains (periodic scans of zones, certificates, trademark filings). A widening gap signals a governance being bypassed.
• Non-aligned third parties: the number of vendors sending without SPF or DKIM alignment, per brand. This is the direct measure of the remediation work left.
• Unknown sources: alerts on IPs never seen before for a given domain, and the time the owner takes to qualify them.
• Wave velocity: the median time from p=none to p=reject per domain, which allows an honest projection of the program's end date.

The classic mistake is steering by email volume rather than by domain count: a fleet whose three high-volume domains sit at p=reject while a hundred and seventy others stay open is not protected — the impersonator always picks the open door.

What DMARCbis simplifies for subdomains

The current standard, DMARCbis, brings two changes that matter especially at fleet scale. The first is the DNS Tree Walk: policy discovery now walks up the DNS tree instead of relying on the Public Suffix List. Intermediate policy points become possible — a group can publish a policy at the level of a brand and cleanly cover the subdomains beneath it, without duplicating records and without depending on an external list that knew nothing of the group's internal structure.

The second is the np tag, the policy for non-existent subdomains. It closes the phantom namespace immediately — the subdomains nobody ever created but anyone can invoke in a From: header — without waiting for the real subdomains to be ready for hardening:

_dmarc.example.com.  TXT  "v=DMARC1; p=quarantine; sp=quarantine; np=reject; rua=mailto:reports@example.com"

Together with the t=y test mode replacing pct, the result is finer and more legible control than before over each domain's descendants. The full interplay between the organizational domain's policy, sp and np is detailed in the DMARC subdomain policy guide — useful reading before fixing the standard policies of the control zone.

In summary

At the scale of a multi-brand group, DMARC stops being a technical project and becomes a governance program. The fleet typology — active, defensive, parked, technical — yields one target policy per category; the central registry, the named owners and the "new sending tool" process prevent the drift; centralized DNS and CNAMEs to a control zone make the fleet steerable; the trajectory in waves reaches p=reject without a big bang; the share of the fleet hardened and the non-aligned third parties measure the progress; and DMARCbis, with the Tree Walk and the np tag, simplifies what remained painful on the subdomain side.

The entry point, for its part, requires no program at all: running the fleet's key domains through a free DMARC analysis establishes the registry's initial state in minutes — published policies, visible sources, holes in the net. Opening an account then makes it possible to follow all two hundred domains in one place and to roll out the waves, until the day the lead indicator shows a fleet entirely at p=reject.