What it does. Execute a phased DMARC rollout by inventorying sending sources, configuring Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-dmarc-policy-enforcement-rollout, or copy the skill folder into ~/.claude/skills/performing-dmarc-policy-enforcement-rollout/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-dmarc-policy-enforcement-rollout/SKILL.md

SKILL.md (verbatim)

name: performing-dmarc-policy-enforcement-rollout
description: Execute a phased DMARC rollout by inventorying sending sources, configuring
  SPF/DKIM alignment, and progressing DNS policy from p=none monitoring through p=quarantine
  to p=reject enforcement, ensuring all legitimate email sources authenticate before
  unauthorized senders are blocked. Use when deploying or advancing an organization's
  DMARC anti-spoofing posture, or when meeting bulk-sender authentication requirements
  from Google and Yahoo.
domain: cybersecurity
subdomain: phishing-defense
tags:
- dmarc
- spf
- dkim
- email-authentication
- anti-spoofing
- phishing
- dns
- email-security
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- PR.AT-01
- DE.CM-09
- RS.CO-02
- DE.AE-02
mitre_attack:
- T1566
- T1598
- T1534
- T1036

Performing DMARC Policy Enforcement Rollout

Overview

Domain-based Message Authentication, Reporting and Conformance (DMARC) is the cornerstone of email anti-spoofing protection. A DMARC rollout progresses through three phases: monitoring (p=none), quarantine (p=quarantine), and full enforcement (p=reject). When configured at p=reject, any email that fails both SPF and DKIM checks is outright rejected. Google and Yahoo now require DMARC for bulk senders (5,000+ emails), driving a 65% reduction in unauthenticated messages. The rollout typically takes 3-6 months for safe deployment.

When to Use

• When conducting security assessments that involve performing dmarc policy enforcement rollout
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Prerequisites

• Administrative access to DNS management for the domain
• Understanding of SPF, DKIM, and DMARC protocols (RFC 7208, 6376, 7489)
• Complete inventory of all legitimate email sending sources
• DMARC reporting analysis tool (EasyDMARC, DMARCLY, Valimail, or dmarcian)
• Email gateway with DMARC enforcement capability

Key Concepts

DMARC Policy Levels

DMARC Record Anatomy

v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc-agg@company.com; ruf=mailto:dmarc-forensic@company.com; adkim=r; aspf=r; fo=1

• p: Policy for organizational domain
• sp: Policy for subdomains
• pct: Percentage of messages subject to policy (for gradual rollout)
• rua: Aggregate report destination (daily XML reports)
• ruf: Forensic report destination (per-failure reports)
• adkim: DKIM alignment mode (r=relaxed, s=strict)
• aspf: SPF alignment mode (r=relaxed, s=strict)
• fo: Failure reporting options (0=both fail, 1=either fails)

SPF and DKIM Alignment

• SPF Alignment: The domain in the Return-Path (envelope sender) must match the From header domain
• DKIM Alignment: The d= domain in the DKIM signature must match the From header domain
• Relaxed: Organizational domain match (sub.example.com matches example.com)
• Strict: Exact domain match required

Workflow

Step 1: Inventory All Sending Sources (Week 1-2)

• Audit all systems sending email as your domain (marketing, CRM, ticketing, transactional)
• Document third-party services: Salesforce, Mailchimp, SendGrid, Zendesk, etc.
• Identify internal mail servers, applications, and relay hosts
• Check for shadow IT email sending (departments using unauthorized services)

Step 2: Configure SPF and DKIM (Week 2-4)

• Consolidate SPF record with all legitimate sending IPs and includes
• Ensure SPF record stays under 10 DNS lookup limit
• Generate and publish DKIM keys for each sending source
• Verify DKIM signing works for all outbound mail paths
• Test with MX Toolbox or dmarcian SPF/DKIM validators

Step 3: Deploy DMARC in Monitoring Mode (Week 4-6)

• Publish initial DMARC record: v=DMARC1; p=none; rua=mailto:dmarc@company.com; fo=1
• Wait 1-2 weeks to collect representative aggregate reports
• Analyze reports to identify unauthorized senders and alignment failures
• Fix SPF/DKIM for all legitimate sources showing failures
• Iterate until all legitimate mail passes DMARC

Step 4: Move to Quarantine with pct Tag (Week 6-12)

• Update to quarantine at 10%: v=DMARC1; p=quarantine; pct=10; rua=...
• Monitor for false positives (legitimate mail being quarantined)
• Increase pct gradually: 10% -> 25% -> 50% -> 75% -> 100%
• Each increase: wait 1-2 weeks and review reports before advancing
• Fix any remaining alignment issues discovered at each stage

Step 5: Advance to Reject Policy (Week 12-20)

• After stable quarantine at 100%, move to reject at 10%: v=DMARC1; p=reject; pct=10; rua=...
• Gradually increase pct: 10% -> 25% -> 50% -> 100%
• Monitor closely for legitimate mail being rejected
• Establish emergency rollback procedure (revert to quarantine)
• Apply subdomain policy: sp=reject for subdomains

Step 6: Ongoing Monitoring and Maintenance

• Continuously monitor DMARC aggregate reports
• Add new sending sources before they start sending
• Review forensic reports for spoofing attempts
• Maintain SPF record as sending infrastructure changes
• Rotate DKIM keys annually

Tools & Resources

• EasyDMARC: DMARC monitoring dashboard with aggregate/forensic report analysis
• DMARCLY: SPF, DKIM, DMARC monitoring with auto-DNS updates
• dmarcian: DMARC deployment and management platform
• Valimail: Automated DMARC enforcement with hosted authentication
• MX Toolbox: DNS record lookup and DMARC validator
• Google Admin Toolbox: DMARC check and diagnostic tools

Validation

• DMARC record published and resolving correctly at _dmarc.domain.com
• All legitimate sending sources pass SPF and/or DKIM alignment
• Aggregate reports show >99% legitimate mail passing DMARC
• Spoofed messages from unauthorized senders are rejected
• No legitimate mail blocked after full p=reject enforcement
• Subdomain policy (sp=) also set to reject

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

DMARC Policy Enforcement Rollout Template

Sending Source Inventory

DMARC Rollout Schedule

Emergency Rollback Procedure

• Reduce pct to previous stable value OR
• Revert policy to previous level (reject->quarantine or quarantine->none)
• Investigate failing source in DMARC reports
• Fix authentication issue
• Resume rollout after confirmation

Sign-off

references/api-reference.md (verbatim)

API Reference — Performing DMARC Policy Enforcement Rollout

Libraries Used

• dnspython (dns.resolver): DNS TXT record queries for DMARC, SPF, DKIM

CLI Interface

python agent.py check --domain example.com
python agent.py audit --domains example.com example.org [--selectors default google k1]

Core Functions

check_dmarc(domain) — Query _dmarc.<domain> TXT

check_spf(domain) — Query domain TXT for v=spf1

check_dkim(domain, selector) — Query <selector>._domainkey.<domain>

audit_domains(domains, selectors) — Full DMARC/SPF/DKIM audit with scoring

DMARC Policy Levels

Dependencies

pip install dnspython>=2.4

references/standards.md (verbatim)

Standards & References: Performing DMARC Policy Enforcement Rollout

Core Protocol Standards

• RFC 7489: Domain-based Message Authentication, Reporting, and Conformance (DMARC)
• RFC 7208: Sender Policy Framework (SPF) for Authorizing Use of Domains in Email
• RFC 6376: DomainKeys Identified Mail (DKIM) Signatures
• RFC 8616: Email Authentication for Internationalized Mail
• RFC 8601: Message Header Field for Indicating Message Authentication Status

Regulatory Requirements (2025)

• Google Bulk Sender Requirements: DMARC required for senders of 5,000+ messages/day to Gmail
• Yahoo Sender Requirements: DMARC authentication required for bulk senders
• PCI DSS 4.0 Requirement 5.3: Anti-phishing mechanisms including email authentication
• NIST SP 800-177 Rev.1: Trustworthy Email guidance

DMARC Policy Progression

SPF Lookup Limit

• Maximum 10 DNS lookups per SPF evaluation (RFC 7208 Section 4.6.4)
• Each include:, a:, mx:, redirect=, and exists: counts as one lookup
• Exceeding 10 lookups causes SPF permerror (treated as fail by some receivers)
• Use SPF flattening tools to stay within limit

MITRE ATT&CK References

• T1566.001: Phishing: Spearphishing Attachment
• T1566.002: Phishing: Spearphishing Link
• T1586.002: Compromise Accounts: Email Accounts
• T1656: Impersonation

references/workflows.md (verbatim)

Workflows: Performing DMARC Policy Enforcement Rollout

Workflow 1: DMARC Phased Rollout

Week 1-2: Discovery
  |
  v
[Inventory all legitimate email sending sources]
  +-- Internal mail servers
  +-- Third-party SaaS (marketing, CRM, support)
  +-- Transactional email services
  +-- Application-generated email
  |
  v
Week 2-4: Foundation
  |
  v
[Configure SPF and DKIM for all sources]
  +-- Publish SPF record with all includes
  +-- Validate SPF under 10 lookup limit
  +-- Generate DKIM keys per sending source
  +-- Test outbound authentication
  |
  v
Week 4-6: Monitor
  |
  v
[Publish p=none DMARC record]
  +-- Collect aggregate reports for 2 weeks
  +-- Analyze: who is sending as your domain?
  +-- Fix alignment failures for legitimate sources
  +-- Identify unauthorized/spoofing sources
  |
  v
Week 6-12: Quarantine
  |
  v
[Move to p=quarantine with gradual pct increase]
  +-- pct=10 (2 weeks) -> check false positives
  +-- pct=25 (2 weeks) -> verify clean
  +-- pct=50 (1 week) -> validate stability
  +-- pct=100 (2 weeks) -> confirm all legitimate passes
  |
  v
Week 12-20: Reject
  |
  v
[Move to p=reject with gradual pct increase]
  +-- pct=10 (2 weeks) -> monitor rejections
  +-- pct=25 (2 weeks) -> verify no legitimate blocked
  +-- pct=50 (1 week) -> near full enforcement
  +-- pct=100 -> FULL ENFORCEMENT ACHIEVED
  |
  v
Ongoing: Maintenance
  +-- Monitor aggregate reports monthly
  +-- Update SPF/DKIM for new sending sources
  +-- Rotate DKIM keys annually

Workflow 2: DMARC Report Analysis

Aggregate report received (daily XML)
  |
  v
[Parse report in DMARC analyzer]
  |
  v
[Categorize sending sources]
  +-- PASS: Legitimate, properly authenticated
  +-- FAIL (known): Legitimate source with auth issue -> FIX
  +-- FAIL (unknown): Unauthorized sender -> INVESTIGATE
  |
  v
[For each FAIL (known)]
  +-- Identify missing SPF include or DKIM config
  +-- Update DNS records
  +-- Wait for next report to confirm fix
  |
  v
[For each FAIL (unknown)]
  +-- Is it spoofing? -> Document for enforcement case
  +-- Is it shadow IT? -> Onboard or decommission
  +-- Is it forwarding? -> ARC chain may be needed

Workflow 3: Emergency Rollback

Legitimate email being rejected (false positive detected)
  |
  v
[Immediate: Roll back pct or policy]
  +-- Reduce pct to previous stable level
  +-- OR roll back from reject to quarantine
  +-- OR roll back from quarantine to none
  |
  v
[Investigate root cause]
  +-- Check aggregate reports for failing source
  +-- Verify SPF/DKIM configuration for source
  +-- Check for forwarding or mailing list issues
  |
  v
[Fix and re-advance]
  +-- Correct authentication issue
  +-- Verify fix in next report cycle
  +-- Resume gradual pct advancement

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.