A CISO needs to know whether the organization's domain controls cover the intended assets and whether important legitimate services still work. A global DMARC percentage answers neither question on its own. Build a small set of measures that separates deployment, observed authentication, evidence freshness and unresolved exceptions.
The measures below are operational recommendations. They use the protocol and reporting boundaries in RFCs 9989 and 9990, but they are not standardized DMARC compliance scores.
Start with an owned inventory
References: RFC 9989 §4.10.1, RFC 9989 §5.4.
Define the domain population from an accountable inventory, including sending domains, non-sending brands, delegated services and relevant subdomains. Record the owner, intended use, policy discovery result and latest verification date. Count explicit records and inherited effective policy separately where that distinction matters.
A deployment metric could be verified in-scope domains with an intended effective policy divided by all in-scope domains. Explain what verified means and which policies meet the organization's objective. Publishing any record is not equivalent to requesting enforcement, and requesting enforcement does not guarantee identical treatment by every receiver.
Measure legitimate-service operation
References: RFC 9990 §3.1.1.8, RFC 9989 §5.3.5, RFC 9989 §5.3.8.
Maintain a verified application-to-domain inventory. For each critical service, record the expected identities, accountable owner, latest representative test and observed aligned results. Display services not observed during the period rather than granting them a pass.
For applicable valid policies and completed evaluations, calculate an observation-based pass rate by summing message counts with an aligned passing SPF or DKIM result and dividing by included message observations. State receiver coverage, time window, duplicate handling and classification criteria. Separate that rate from a service coverage metric, whose denominator is applications rather than messages.
Work through a misleading average
Synthetic example: a marketing service has 99,990 passing observations, while a verified invoice route has ten failing observations. The combined pass rate is 99.99 percent. The invoice route's observed pass rate is zero out of ten, and one of two listed services has an unresolved authentication problem.
Those facts justify an urgent invoice-route investigation even though the headline rate is high. They do not prove that all ten invoices were rejected or that every invoice receiver contributed a report. Show the invoice owner's confirmation, sample-message evidence and recovery status beside the metric.
Add visibility and exception measures
Track the latest covered interval and arrival lag for important reporters. Show unclassified observed volume, untested critical routes and overdue ownership decisions. A change in contributing reporters can change a percentage without any sender improvement. Mark such changes rather than blending them into a trend.
For exceptions, measure age, business criticality, next action and expiry rather than only the number of open tickets. A single long-lived exception affecting a payment workflow may deserve more attention than many quickly resolved low-impact observations. Do not call all unknown-source failures blocked attacks.
Make the board summary auditable
For every published number, retain its population, numerator, denominator, calculation revision, evidence date and accountable owner. Include a drill-down to critical services and known gaps. Use unavailable when the denominator is zero or the evidence is absent.
The control statement should say what is configured, what has been observed operating and what remains uncertain. Review after domain acquisitions, provider migrations or new sending applications. A strong metric programme makes those changes visible and creates specific remediation decisions; it does not turn an incomplete dataset into a universal security assurance.
Continue the investigation
Use the aggregate-report walkthrough for the underlying fields and the alignment diagnosis guide when raw authentication success does not satisfy DMARC.
Keep the illustration within its evidence
The local synthetic calculation gives 99,990/100,000 = 99.99% overall pass but 0/10 = 0% for invoices. One of two named services remains problematic under the supplied scenario. This is not a measured estate coverage score, delivery-loss count or industry benchmark.