Email Authentication Checklist

1. Map the sending estate

List normal mailboxes, marketing systems, support tools, invoicing services, website forms, application mail, scanners and any supplier that sends using your domain. Record the envelope sender, visible From domain and DKIM signing domain for each.

2. Establish authentication

Publish one maintained SPF record, enable DKIM with a unique selector for each provider where possible, then check real external message headers for pass results. DNS existence alone is not proof that outgoing mail is signed correctly.

3. Introduce DMARC safely

Start with monitoring, review reports, correct alignment and only then increase enforcement. Keep a change record and an emergency rollback value. Recheck authentication whenever a sending platform is added or retired.

4. Maintain operational basics

Use TLS where supported, keep abuse and postmaster routes monitored, provide working unsubscribe controls for subscribed messages and monitor complaint and bounce rates. Authentication reduces spoofing risk; it does not make unwanted or poor-quality mail desirable.

Build an evidence table

For every sender record the service owner, visible From domain, envelope domain, DKIM signing domain, sample message date, SPF result, DKIM result and DMARC alignment. A sender is not complete merely because it appears in a vendor list.

Acceptance test

Send from each real workflow—including mailbox, website, billing, marketing and support—to an independent recipient. Retain only non-sensitive authentication headers and confirm the expected aligned mechanism passes.

Change control

Save the former DNS value and TTL, publish one bounded change, wait for the relevant caches, retest and record the outcome. Re-engage the prior value if legitimate mail fails.