performing-dmarc-policy-enforcement-rollout

Execute a phased DMARC rollout from p=none monitoring through p=quarantine to p=reject enforcement, ensuring all legitimate email sources are authenticated before blocking unauthorized senders.

跳到安装

仓库: xalgord/xalgorix
最近来源活动: 2026年6月6日 16:41
检测到的 SKILL.md 语言: 英语
星标: 813
分支: 146

安装方式

默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

直接命令不会经过审查 Prompt；运行前请先检查来源。

npx skills add https://github.com/xalgord/xalgorix --skill performing-dmarc-policy-enforcement-rollout

命令会保持在同一行。复制前请横向滚动并检查完整内容。

想先保存到本地？可下载 SkillsMP 当前能够提供的文件。

检查来源文件

决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。

SKILL.md

来源说明 · 只读预览

返回搜索返回安装

exploiting-http-request-smuggling

Detecting and exploiting HTTP request smuggling vulnerabilities caused by Content-Length and Transfer-Encoding parsing discrepancies between front-end and back-end servers.

2026-07-20

exploiting-oauth-misconfiguration

Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.

2026-07-20

exploiting-subdomain-takeover-vulnerabilities

Identifying and exploiting dangling DNS records pointing to unclaimed cloud services, enabling subdomain takeover for phishing, cookie stealing, and authentication bypass during authorized penetration tests.

2026-06-19

查看这个仓库的全部 Skills

Performing DMARC Policy Enforcement Rollout

Overview

Domain-based Message Authentication, Reporting and Conformance (DMARC) is the cornerstone of email anti-spoofing protection. A DMARC rollout progresses through three phases: monitoring (p=none), quarantine (p=quarantine), and full enforcement (p=reject). When configured at p=reject, any email that fails both SPF and DKIM checks is outright rejected. Google and Yahoo now require DMARC for bulk senders (5,000+ emails), driving a 65% reduction in unauthenticated messages. The rollout typically takes 3-6 months for safe deployment.

When to Use

When conducting security assessments that involve performing dmarc policy enforcement rollout

When following incident response procedures for related security events

When performing scheduled security testing or auditing activities

When validating security controls through hands-on testing

Common Misconfigurations & Verification

Stuck at p=none: monitoring indefinitely yields reports but no anti-spoofing protection - commit to advancing through quarantine to reject on a 3-6 month timeline.

Jumping straight to p=reject: skipping the pct ramp blocks legitimate sources that aren't yet aligned - step pct 10->25->50->100 at each policy level with 1-2 weeks of report review between increases.

SPF over the 10-lookup limit: too many include: entries cause permerror and silent failure - flatten and consolidate before enforcing.

DKIM signing missing on a sending source: marketing/CRM/ticketing platforms (Mailchimp, SendGrid, Zendesk) often go unsigned and get rejected at p=reject - inventory and sign every source first.

Alignment vs. pass confusion: a source can pass SPF/DKIM yet fail DMARC because the domain doesn't align - check alignment in aggregate reports, not just auth pass.

No subdomain policy / no rollback plan: omit sp=reject and subdomains stay spoofable; keep an emergency revert (reject->quarantine) ready.

Verification: confirm aggregate reports show >99% legitimate mail passing with alignment before each step; send a self-domain spoof from an unauthorized IP and confirm it is rejected; verify no legitimate source is blocked after full p=reject and sp=reject.

Prerequisites

Administrative access to DNS management for the domain

Understanding of SPF, DKIM, and DMARC protocols (RFC 7208, 6376, 7489)

Complete inventory of all legitimate email sending sources

DMARC reporting analysis tool (EasyDMARC, DMARCLY, Valimail, or dmarcian)