DMARC configuration

Staged rollout from p=quarantine to p=reject for Meridian transactional mail.

Phase 1 — Monitor

_dmarc.getnimbus.net. 3600 IN TXT
"v=DMARC1; p=none; rua=mailto:dmarc@getnimbus.net;
ruf=mailto:dmarc-forensic@getnimbus.net; fo=1"

Collect aggregate reports for 14 days. No policy enforcement.

Phase 2 — Quarantine

_dmarc.getnimbus.net. 3600 IN TXT
"v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@getnimbus.net"

Quarantine 25% of failing mail. Ramp pct weekly: 25 → 50 → 75 → 100.

Phase 3 — Reject

_dmarc.getnimbus.net. 3600 IN TXT
"v=DMARC1; p=reject; rua=mailto:dmarc@getnimbus.net"

Full enforcement. All failing mail rejected at receiving MTA.

Prerequisites: SPF -all and DKIM signing with d=getnimbus.net must be in place before enabling DMARC enforcement.

← Back to docs