Email Authentication Change and Rollback Checklist

Capture the baseline

Save the full existing record, name, type, TTL, provider, observed authentication results and known senders. A screenshot alone may omit significant text.

Define the hypothesis

State the exact problem and expected evidence—for example, DKIM should pass and align for messages sent by the billing platform.

Change one control

Avoid changing SPF, DKIM and DMARC enforcement simultaneously. One bounded change makes failures and recovery easier to attribute.

Wait for relevant caches

DNS propagation is not a single global moment. Use the TTL and provider behaviour to decide when tests are meaningful without assuming every resolver refreshes together.

Run production-path tests

Send through every affected legitimate workflow to independent recipients and inspect received headers. Check aggregate evidence over an appropriate period before broader enforcement.

Rollback and record

If legitimate mail fails, restore the exact previous value through the authorised DNS process and retest. Record the outcome, incident owner and next decision without storing credentials.