A reproducible DMARC adoption study begins with a question that its observations can answer. A query for a policy record can establish what a resolver returned for that name during a collection window. It cannot establish whether every message sent by an organisation passes authentication, whether recipients accepted those messages or whether the organisation has experienced fraud.
Write a protocol before looking at results
State the target population, sampling frame and observation unit separately. A target might be registered institutions in a jurisdiction; a frame might be an official list of website domains; the unit actually queried might be one DNS owner name. These are different objects. Version the entity-to-domain mapping and state why a domain is included. Freeze exclusions, retry limits, resolver choice and classification rules before collection so an inconvenient timeout cannot disappear from the denominator later.
Preserve observations before interpreting them
Keep raw responses, HTTP status, DNS response code, owner name, record type, returned TTL and client timestamps. Store the script revision and a hash of every retained file. Separate transport errors from a successful DNS response with no requested answer. A DNS name error, an empty answer and a timeout are not interchangeable findings. Explain which statuses the classifier can recognise and which require manual review.
Make the publication auditable
Publish counts with denominators and unresolved observations beside them. A graph without the queried population, collection dates and classification version cannot be independently interpreted. Ask a second analyst to reproduce the offline summary from the frozen responses before asking them to run new network queries. New queries test the present, not the past. Preserve both runs and explain any difference rather than overwriting the older data.
Apply a transparent hypothetical decision
Suppose ten declared domains produce six candidate policy strings, two successful responses without the requested data and two timeouts. Keep all ten attempted observations. Report six candidate strings out of ten attempted domains, with the two empty responses and two unresolved timeouts separately. Do not call this six valid deployments: syntax, policy discovery and sender-domain coverage still require their stated checks. A complete-case calculation must identify its different denominator. These invented counts explain classification only; no collection was executed.
Technical boundary and publication decision
RFC 9989 Sections 4.7, 4.10.1 and 5.3 distinguish record syntax, policy discovery and message evaluation. An exact-owner TXT observation is not full policy discovery. RFC 9990 Section 3.1 describes aggregate message evidence, which is separate from a domain crawl. RFC 2308 Section 2 distinguishes negative DNS responses; a client timeout is not proof of absence. Study-design choices here are editorial methodology, not statistical requirements prescribed by those RFCs. This teaching revision makes no historical pilot or national adoption finding; any later empirical result needs its own accessible, hash-bound data and independent method review.