[ Business value ]

Choose a DMARC operating model based on the work left with your team

Choose the operating model by assigning the work, evidence and escalation that remain with your team.

By the EmailAuth research team · 3 min read

[ Key points ]

  • Choose the operating model by assigning the work, evidence and escalation that remain with your team.
  • Budget investigation, oversight and incident duties that remain with your team, even when routine review is delegated.
On this page

Inventory recurring work

Buying a dashboard does not assign ownership of an unknown sender. List the actual work: collect reports, investigate sources, confirm business legitimacy, coordinate provider changes, approve DNS edits, validate affected routes and review exceptions. Give every task a responsible operator and an accountable internal owner. Ask who covers absence and incidents, not just who attends onboarding.

Separate an offered capability from the customer's retained responsibility. A managed service may investigate reports without authority to change DNS. An internal administrator may hold DNS access but lack authority to approve a marketing sender. Record these boundaries explicitly before comparing service labels. RFC 9990 describes aggregate evidence, but does not prescribe a commercial support model.

Build a requirement and workload matrix

For each task, record frequency, expected evidence, operator, approver, escalation target and exit artifact. Require a sample investigation showing how raw observations became an owner-confirmed decision. Ask whether the service exports the underlying records, labels and decision history in a usable form. A screenshot alone is a weak substitute for evidence another operator can inspect.

The hypothetical workload example compares self-operated and assisted arrangements. Twelve routine reviews at twenty minutes each and four sender investigations at forty-five minutes each total seven internal hours. Delegating routine review leaves three investigation hours internally, plus one assumed oversight hour, totaling four. These invented assumptions demonstrate arithmetic, not measured savings. Incident effort, onboarding, fees and delays are excluded and must be budgeted separately.

Test the operating boundary

Give the proposed operator a sender that authenticates successfully but uses an unaligned domain, a legitimate forwarding exception and an unknown shared IP. Ask it to identify the next safe action, the evidence still needed and the person authorized to approve change. The best outcome may be a well-supported hold rather than a quick DNS edit.

Before committing, rehearse a handover with exported evidence and a new operator. Verify who can remove access, recover credentials under approved procedures and restore the last approved configuration. Compare total workload and contractual commitments using current written terms. Do not infer pricing, service levels or autonomous functionality from a category name. This guide evaluates work allocation and makes no claim about a named platform's features or commercial terms.

Completed fictional responsibility matrix

This written example assigns twelve monthly routine reviews at twenty minutes each to the internal administrator in the self-operated model and the contracted operator in the assisted model. The mail service owner approves the outcome; dated raw-report reviews and an exception log are the evidence; unresolved cases escalate to that owner; raw reports and review history must survive exit.

Four monthly sender investigations at forty-five minutes each remain with the internal administrator. The business sender owner approves the decision, supported by identity samples and owner confirmation. Suspected misuse escalates to the security incident lead. The sender inventory and decision history are the exit artifacts. In the assisted model, one sixty-minute oversight review belongs to the internal mail service owner, with security-owner approval and escalation to the service manager. Its output is an open-case ledger and access inventory. The arithmetic totals 420 internal minutes for self-operation and 240 for assisted operation. These are invented monthly assumptions, not measured labor savings.

Make the workload decision reproducible

The baseline calculation is 12 × 20 + 4 × 45 = 420 minutes; the assisted internal workload is 4 × 45 + 60 = 240 minutes. If oversight instead takes 180 minutes, assisted internal work rises to 360 minutes. The apparent three-hour reduction would shrink to one hour before fees, onboarding and incidents. Validate those assumptions with your own records before choosing a model; no measured saving or provider capability is claimed. RFC 9990 Section 3.1 explains aggregate report evidence and RFC 9989 Section 5.4 explains authentication limits, not commercial staffing guarantees. No software fixture, service trial or production change was executed.

[ Takeaway ]

Budget investigation, oversight and incident duties that remain with your team, even when routine review is delegated.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Preserve decision evidence

Record the exact inputs and observations needed to repeat this specific evaluation.

Next steps

  1. Assign an operator and approver to every recurring authentication task.
  2. Keep raw evidence separate from interpretation and labels.
  3. Verify any live change through the authorized change process.

CISO / SecOps

Control authority and uncertainty

Prevent incomplete observations from turning into unsupported security or compliance conclusions.

Next steps

  1. Rehearse evidence export and revocation before approving the operating model.
  2. Require explicit approval for consequential changes.
  3. Retain unknowns and negative controls in the final decision record.

Founder / Non-technical

Own the decision

Keep the evaluation tied to the business task and the limits of the evidence.

Next steps

  1. Budget retained investigation and oversight effort using stated assumptions.
  2. Assign an accountable owner for unresolved cases.
  3. Review retained workload and exit requirements before committing.

[ FAQs ]

Frequently asked questions

Is a dashboard an operating model?

No. Assign investigation, approval, change and escalation responsibilities.

Who should approve a new sender?

An accountable business owner with the appropriate technical and security review.

Can managed operations mean no internal work?

Not necessarily. Confirm retained decisions, oversight and incident duties.

Are the workload savings measured?

No. The seven-hour and four-hour totals use explicitly invented assumptions.

What evidence should a review produce?

Raw observations, interpretation, uncertainty, owner confirmation and next action.

Should incidents be in the cost model?

Yes. The hypothetical arithmetic excludes them, so add separately justified assumptions.

What should exit testing include?

Usable exports, ownership transfer, access removal and a recovery plan.

Does this recommend a particular service?

No. Evaluate current evidence against your own requirements.

[ Sources ]

Sources

  1. RFC 9990

    Sections §3.1 · §7

  2. RFC 9989

    Sections §4.4 · §4.7 · §4.10.1 · §5.3.5 · §5.4

[ Glossary ]

Glossary

Retained work
Tasks and decisions that remain with the customer under the chosen operating model.
Exit artifact
Usable evidence and configuration history required to transfer operations safely.
Oversight
Customer review of open cases, operator decisions, access and service performance.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base