Web3 DMARC enforcement checklist

The failure mode this checklist prevents

Web3 teams rarely have one mail system. Authentication email may leave through a transactional provider, treasury notices through an incident tool, support through a help desk, and governance or product updates through a newsletter platform. A stricter DMARC policy applies to the visible From domain across those paths. One forgotten stream can turn a legitimate wallet-security alert into a DMARC failure at the worst possible moment.

DMARC enforcement is not a DNS-only switch. Public records show the intended policy, but a receiver's Authentication-Results header and the provider's delivery logs show what actually happened to a message.

1. Inventory every message stream

Create one row per sending path, not one row per domain. Wallet alerts and newsletters can share a visible From domain while using different infrastructure, owners, DKIM identities, and failure procedures.

Business stream

Wallet or login alert, transaction receipt, governance notice, support reply, incident update, lifecycle message, or newsletter.

Visible identity

Exact RFC5322.From domain shown to the recipient, including any delegated subdomain.

Authenticated identities

SPF MAIL FROM or HELO domain, DKIM d= signing domain, and DKIM s= selector from a real delivered message.

Infrastructure

Provider, sending IP ownership, Return-Path domain, expected PTR hostname, and any forwarding or mailing-list path.

Accountability

Internal owner, provider owner, last verified date, emergency contact path, and rollback decision maker.

2. Collect receiver evidence for each row

1. Send one controlled message through the exact production path. A provider's DNS setup screen is not proof that the final message aligned.
2. Use the receiving mailbox's Show original, View source, or Download original command. Preserve the complete header; a screenshot omits the identities and route needed for diagnosis.
3. Record the receiver's SPF, DKIM, and DMARC results together with the domains each result evaluated. Prefer the result added at the receiver's trusted boundary.
4. Compare the visible From domain with the passing SPF MAIL FROM domain and every passing DKIM d= domain. Document which path creates the aligned pass.
5. Repeat for normal, failover, incident, and regional routes. A dormant emergency sender is still part of enforcement scope.

Headers can contain recipient addresses, internal hostnames, IP addresses, and message identifiers. Keep them local when possible. The browser-local header analyzer does not upload the pasted header.

3. Separate authentication from alignment

SPF authorizes the connecting server for an envelope identity; it does not directly authenticate the visible From address. DKIM validates a signature made by the d= domain; that signer can also be unrelated to the visible brand. DMARC passes when at least one of those passing identities aligns with the visible From domain under the published strict or relaxed mode.

Forwarding commonly breaks SPF because the forwarder becomes the connecting server. Mailing lists can modify signed content and break DKIM. ARC can preserve earlier authentication context, but it does not remove the need to understand the final receiver, expected indirect flow, and business owner.

4. Verify the surrounding sender controls

• Confirm there is exactly one SPF record and that its observed include or redirect path does not exceed the ten DNS-querying-term limit. Treat an incomplete lookup expansion as unresolved evidence, not a pass.
• Check each real DKIM selector from a delivered message. Do not guess common selectors, and keep old selectors only for the provider's documented rotation window.
• Use each actual public sending IP to verify PTR and forward-confirmed A or AAAA records. A domain-only scan cannot establish reverse DNS.
• Check provider-specific bulk-sender requirements, TLS, consent, complaint rates, and one-click unsubscribe separately. DMARC alignment does not prove those controls.
• Confirm subdomain intent. Under RFC 9989, p, sp, and np can produce different handling for the organizational domain, existing subdomains, and non-existent subdomains.

5. Observe a complete operating cycle

Publish monitoring with an aggregate-report destination, then analyze enough receiver reports to cover normal volume, low-frequency operations, failover tests, and at least one incident drill. RFC 9990 aggregate data can reveal an unexpected source, but source IP alone does not identify the business owner. Reconcile every recurring source with the inventory and provider logs.

For domains whose users send through Internet mailing lists, RFC 9989 specifically recommends at least a month at p=none, followed by an equally long period at p=quarantine, before considering p=reject. Other domains should choose an observation window that covers their real operating cycle rather than an arbitrary message count.

6. Enforce with a tested rollback

1. Freeze the inventory and name the person who can approve a policy change and the person who can restore the previous record.
2. Lower DNS TTL early enough for the planned change window, following the DNS provider's behavior and organizational change policy.
3. Move from monitoring to quarantine only after all required rows have aligned receiver evidence. Continue comparing aggregate reports, delivery logs, authentication headers, and support signals.
4. Move to reject only when quarantine has covered the expected operating cycle and the rollback drill succeeded.
5. Do not rely on the historic pct tag for a percentage rollout; RFC 9989 removed it because receiver behavior was inconsistent. Segment by controlled subdomain or message path when the architecture permits, and verify any use of the newer t=y testing request against current receiver behavior.
6. If legitimate traffic fails, preserve the header and provider logs, identify the exact stream, restore the last known policy when required, and fix the authenticated identity before resuming enforcement.

Run the public checks before the change window

The free scanner reads public MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT, CAA, and optional sending-IP DNS. It requires no account, mailbox access, wallet connection, or DNS credential. Use the focused tools for DMARC policy discovery, SPF lookup counting, DKIM selector checks, and PTR verification.