Build a practical sender inventory before tightening email authentication, so legitimate business messages are part of the plan.
Start with the business process
Your main email platform is rarely the only service sending mail for the organisation. Website forms, invoices, support desks, recruitment tools and marketing systems may all use the business domain. Ask the owners of those processes what they send and how important delivery is. Begin with the services that affect customers, payments and access to work.
Record the sender and its owner
For each service, record its purpose, domain, provider and internal owner. Include who can change the settings and who can confirm successful delivery. Keep secret keys and passwords out of this inventory. If a service has no clear owner, resolve that uncertainty before making changes that could interrupt it.
Understand the authentication pieces
SPF identifies authorised sending servers for a domain used in the mail transaction. DKIM adds a signature that receivers can verify. DMARC connects authentication alignment to a policy and reporting. These mechanisms have different roles; enabling one setting does not automatically establish that every sending service is configured correctly.
Check real messages and configuration
Work with the relevant administrator to examine representative legitimate messages and the provider’s configuration guidance. Compare what is actually sent with the inventory. Include secondary domains and less frequent notifications. A system that sends only at month-end may not appear in a short observation window, yet still be important to finance or customers.
Plan enforcement deliberately
Use reporting and controlled validation to understand current behaviour before tightening policy. Agree who reviews failures, which business owners need to test and how an unexpected delivery problem will be handled. Avoid treating a copied DNS record as a complete implementation. The right sequence depends on the services and existing setup.
Keep the limitations visible
Authentication is valuable, but it does not establish that the contents of a message are trustworthy. A real account can be compromised, and attackers can register similar-looking domains. Maintain payment verification, sign-in protection and staff reporting alongside domain authentication. The inventory should support a broader security process, not replace it.
Make the inventory part of change management
When a new sending tool is purchased or an old one is retired, update the record and validate the resulting configuration. Assign a review owner and retain useful evidence of tests and decisions. A small, maintained inventory is more valuable than a large spreadsheet that nobody checks after the initial rollout.
Further reading: CISA: DMARC guidance.