Before strengthening a DMARC policy, find out which systems actually send mail using your business domain. The inventory is not just an IT list: invoices, payroll notices, website forms, customer support and occasional campaigns may each follow a different sending path.
This guide supplies an original working method and a downloadable record. It does not tell you to paste a universal DNS record into production. Start with the SPF, DKIM and DMARC explainer if the terminology is unfamiliar; this page owns the narrower task of collecting sender evidence and making a change decision.
Find mail streams, not just software subscriptions
Ask each team to name the messages it cannot afford to lose. A subscription list misses a scanner in reception, a website contact form maintained by an old supplier, or a yearly renewal notice that nobody sent during the observation period. Give each stream a named business owner and technical contact.
Make separate rows when one platform uses different domains or sending configurations. A CRM's staff email integration and its bulk campaign engine should not automatically share one approval. Record the visible From domain and the workflow that triggers the message, not customer addresses or message bodies.
- Finance: invoices, statements, purchase orders and payment reminders.
- People operations: recruitment, payroll notifications and onboarding messages.
- Sales and marketing: campaigns, booking confirmations and CRM sequences.
- Service delivery: ticket updates, monitoring notices and customer portal messages.
- Infrastructure: multifunction printers, line-of-business applications and website forms.
For each row, record whether the stream is active, seasonal, retired or unconfirmed. An unrecognised source is an investigation item: it could be an overlooked legitimate service or unauthorised activity. Do not automatically authorise it just because it appears in a report, and do not label it an attacker without evidence.
Collect evidence at the recipient, with permission
Send a harmless, approved test message through the real workflow to a mailbox you control. A provider's configuration screen is helpful, but record what the receiving system actually evaluated. Use its trusted authentication results, rather than trusting an arbitrary header supplied by the sender.
DMARC requires an authenticated identifier to align with the visible From domain: either passing SPF with an aligned envelope-sender domain, or passing DKIM with an aligned signing domain. A plain SPF pass for the vendor's unrelated domain is not enough. Microsoft's DMARC configuration guidance explains this distinction and the use of aggregate reports to monitor sending sources.
Keep a restricted evidence reference in the worksheet. Full headers can expose addresses, routing details and identifiers; do not paste them into a public ticket or this website. Write down the test date, receiving provider, authentication outcomes, relevant domains and the analyst's conclusion. If you cannot obtain reliable results, mark the row unverified.
Review representative business cycles as well as deliberate tests. A quiet weekend does not cover month-end billing. Reports are useful corroboration, but do not assume every receiver reports or every legitimate stream has been exercised. Ask the business owner to confirm the observation window includes its important workflows.
Separate authentication, alignment and delivery
| Visible From domain | Observed evidence | Inventory conclusion |
|---|---|---|
| example.com | SPF passes for vendor.example.net; DKIM passes with d=example.com. | The DKIM identifier matches the From domain. DMARC has an aligned passing path. |
| example.com | SPF passes for vendor.example.net; DKIM fails. | No aligned passing path is shown. Do not approve this stream merely because SPF passes. |
| example.com | The worksheet only says “delivered”; authentication results are unavailable. | Delivery alone does not demonstrate DMARC. Mark alignment unverified and collect evidence. |
These cases use exact domain matches to avoid hiding strict-versus-relaxed alignment differences. Have the administrator evaluate the actual policy, identifiers and subdomains in your environment. Forwarding and message modification need their own test cases; do not copy a direct-send result into that row.
Authentication also does not establish that an invoice is genuine or a payment request was authorised. A compromised account can send authenticated mail. Keep payment verification and account-security controls separate from this inventory.
Use a change gate, not a calendar-only rollout
Choose an approved change window and a named person who can modify DNS. Record the current value and intended change in the restricted change ticket. Agree which business symptoms require a pause, who receives reports and where the provider support contacts are stored.
- Inventory gate: business owners have reviewed active and seasonal streams; unknowns have an owner and a decision.
- Evidence gate: critical workflows have current recipient-side results and an explained alignment outcome.
- Readiness gate: the administrator has reviewed the proposed domain and subdomain policy; the rollback authority and communication route are available.
- Change gate: make the approved bounded change, retain the previous record and immediately exercise the agreed workflows.
- Acceptance gate: compare technical results and business outcomes; record unresolved items and the next review date.
A pause does not mean blindly adding every sender to the root SPF record. Ask the provider which envelope domain and DKIM signing configuration its particular service uses. If a workflow fails after the change, preserve the evidence, involve its owner and follow the approved recovery decision. DNS caching means changing a record back is not an instant, universal rollback.
A DMARC policy expresses requested receiver handling, not a guarantee of delivery or rejection. The Cyber Centre's email-domain protection guidance notes that receivers can override published policy. Google's sender guidelines also cover requirements beyond authentication, including message format, reputation-related behaviour and unsubscribe support for relevant traffic.
Download and maintain the sender inventory
Download the sender inventory and change-gate worksheet
The plain-text worksheet is designed for your own documentation system. It includes stream ownership, domain evidence, seasonal coverage, approval gates and a follow-up log. Duplicate the sender block as needed. Blank fields mean work remains; they are not a compliance score.
Reopen a row when a provider, domain, integration or sending method changes. Ask procurement and marketing to include email ownership in onboarding and retirement. Keep a retired stream in the history long enough for your approved recordkeeping needs, with the retirement date and confirmation that its credentials or sending configuration were addressed.
Our free domain check can show selected public DNS signals. It cannot inventory your suppliers or prove that a message passes alignment at a recipient. For help reviewing the evidence and coordinating a change, request a scoped email-authentication review. North Star provides remote service across Canada, with physical dispatch from Prince George and Grande Prairie.