set up your policy domain for 27 or 28 days. This will always ensure you have a 3 week recovery window. 27 will do what is needed as long as you run your full backups on a weekly schedule and do not miss any.