Northwind Health: moving DMARC from p=none to reject with a broken SPF chain

Failure paths, in order of likely volume

1. SPF permerror from the lookup limit. RFC 7208 caps a record at 10 DNS-querying terms. At 11, receivers return permerror, which counts as no SPF result at all - not a soft fail. Any stream whose only authentication is SPF is therefore unauthenticated.
2. SPF passes but alignment fails (marketing). The envelope sender is bounce.esp-marketing.example, so SPF authenticates the ESP's domain. DMARC compares that against the From domain's organizational domain under relaxed alignment: esp-marketing.example is not northwind.example. Fail.
3. DKIM passes but alignment fails (marketing). d=esp-marketing.example does not align with From: northwind.example. Neither mechanism aligns, so the message fails DMARC even though both technically pass.
4. No authentication at all (e-fax). Sender IPs are in no SPF record; the record ends in -all, so SPF fails; no DKIM signature. Fail.
5. Forwarding and mailing lists. Forwarding breaks SPF (new envelope sender) and often breaks DKIM if the body is modified. These appear as failures you cannot fix by editing your own DNS.

What the rua reports show: counts per reporting domain, the SPF and DKIM results, the alignment results, and the applied disposition.

What they hide: which internal stream produced the message, whether SPF passed on the envelope domain, and the difference between 'SPF aligned fail' and 'SPF permerror'. Sample message headers from each stream, or enable forensic reporting, before you set policy.

Days 1–7 - inventory, not policy. Pull 30–60 days of aggregate reports plus a sample of raw headers from each known stream (internal MTA, marketing, CRM, e-fax, any SaaS that sends as your domain). Every sender must be listed with: sending domain, envelope domain, signing domain and selector, and whether From domain is the org domain or a subdomain.

Days 1–7 - repair SPF. Remove includes that no longer send. Flatten host lookups into ip4/ip6 where the vendor's ranges are stable, and move high-churn vendors to their own subdomain with a delegated SPF record. Target ≤8 lookups to leave headroom, because the limit applies to every receiver's recursive evaluation, not just your checker's count. Note that simply deleting the e-fax include is not a fix - the e-fax stream currently has no include.

Days 7–14 - fix marketing alignment. Either have the ESP sign with d=northwind.example using a selector CNAME you control (k1._domainkey.northwind.example), which keeps the visible From unchanged, or move the stream to m.northwind.example. CNAME-based signing is usually the fastest route and gives you DKIM alignment independent of the ESP's bounce domain.

Days 7–14 - e-fax. Add its published ranges to SPF, or move it to fax.northwind.example with its own record and policy. Until it authenticates, it cannot pass DMARC under any policy.

Days 14–21 - p=quarantine, ramped. pct=25, then 50, then 100, watching reports daily for a stream you missed. Handle forwarded mail with ARC where receivers honour it, and accept a residual failure rate rather than blocking the whole policy.

Days 21–30 - p=reject, keeping rua and adding ruf for sampled failures so future breakage is diagnosable within hours.

Why 'p=none on the org domain' is the wrong lever. DMARC policy applies to the domain in the From field, and a missing subdomain policy (sp) inherits p. Setting the org domain to none to protect marketing therefore also forces none onto every subdomain and onto the transactional streams that are already clean - you would trade enforcement everywhere to protect one sender.

Proposed design.

• _dmarc.northwind.example: p=reject; sp=reject; rua=...; ruf=...; adkim=r; aspf=r. This covers the apex, the internal MTA, e-fax (once it authenticates) and any subdomain without its own record.
• _dmarc.m.northwind.example: p=quarantine; pct=100; rua=..., with the marketing platform sending From: [email protected], its own SPF record (under 10 lookups) and a DKIM selector CNAME under m.northwind.example.

Why this works. The marketing stream gets its own enforcement ramp without holding the apex hostage, and because the ESP controls the subdomain's DNS records it can be repaired or re-pointed without touching corporate mail. It also gives you per-stream reporting so a marketing regression is visible in isolation.

Costs to be explicit about. The visible From address changes from northwind.example to m.northwind.example, which affects brand recognition, reply handling, and any allowlists keyed on the apex domain; and subdomain reputation is partly inherited but not fully, so deliverability should be re-baselined. Do not set sp=none as a compromise 'just for now' - it silently becomes the policy for every future subdomain, including ones spun up by engineering without telling the mail team.