Collect the real sending routes first
List the sending methods in use and identify a contact for each. Record the visible sender address and the service dispatching the message. Ask about infrequent functions too, such as automatic reminders. A successful office test email does not cover those other routes.
Distinguish active services from old records whose purpose is unclear. Do not remove unfamiliar values without investigating them. An application still in use may send only occasionally and therefore remain absent from a brief observation. Keep unconfirmed entries as open questions rather than making the inventory appear complete through guesswork.
Understand three different checks
SPF identifies sending systems authorized for the domain being checked. DKIM uses a digital signature verified with a published key. DMARC combines a successful SPF or DKIM check with alignment to the visible From domain and a published policy. The exact relationship depends on the chosen alignment mode.
These terms are not interchangeable boxes to tick. A DNS record being present does not establish that every real sending route passes the intended check. Have the results inspected on actual messages from the services in use. The administrator should be able to explain which service supplies which evidence and which cases remain under investigation.
Do not copy another organization's example values
Configuration needs to match your services and domain. An example line found online is not a universal setting. Have values derived from the participating providers' current instructions and reviewed together. Several independently copied records may conflict or overlook an existing route.
Before changing anything, preserve the previous values and their known purposes. Identify the person making the change and the tests that follow. When another application is introduced, make this review part of its introduction. Do not wait until customers report that automated messages are missing before investigating how the new service sends.
Assess policy changes gradually
A stronger DMARC policy can affect messages that do not pass the necessary check. Google recommends gradual introduction with report review. Organisationally, decide who evaluates the observations and when a change has been sufficiently tested. A report address that nobody monitors does not provide an assessment.
Do not infer from one successful message that every sender has been included. Match the observation period to the processes actually used. A service sending only at month end may not appear during a short mid-month trial. That relationship between working schedules and technical evidence belongs in the change plan, especially when several teams use different systems.
Record results for each route
Arrange recognisable tests from the different systems. Have the technical results inspected at the receiving end and also record whether the message arrived in the intended mailbox. Authentication and the actual placement of a message are different observations. Passing one check does not guarantee every future delivery.
When one route differs, describe it with the service, sender, time and result. Avoid changing every domain setting simultaneously. A targeted correction followed by a new test is easier to assess. For forwarding or more complex delivery chains, have the responsible specialist investigate the actual route rather than comparing only the visible sender name.
Maintain the record as tools change
Connect the sender list with domain and software documentation. Whenever a service is replaced or retired, review its existing records and tests. A configuration that suited the organization a year ago may be incomplete after several tool changes. Add ownership of this review to the handover instead of assuming the new supplier will know every old route.
Close the work with a clear statement of the systems tested, configuration confirmed and unresolved questions. The person responsible for the business process need not perform every technical action. They do need traceable evidence that the routes actually used have been considered, plus a named person who will handle the next change. Keep that statement alongside the inventory so it remains useful beyond the original setup.
