NORTH STAR - DMARC SENDER INVENTORY AND CHANGE GATES
Version 1 - 2026-09-06
Original operational template, not a performed test or compliance certificate.
Keep completed records in your restricted documentation system. Do not include
passwords, API keys, full message bodies, customer addresses or unredacted headers.

CHANGE RECORD
Ticket/reference:
Domain(s) in scope:
Business approver:
Technical operator / backup contact:
Approved window:
Current DNS value evidence reference (restricted):
Proposed policy evidence reference (restricted):
Previous value / rollback authority / communications reference:
Critical workflow stop criteria:
Report review owner:

SENDER BLOCK - duplicate once per distinct stream
Stream ID / platform / workflow:
Business owner / technical contact:
Active / seasonal / retired / unconfirmed:
Visible From domain:
Envelope-sender domain:
DKIM signing domain(s):
Provider setup documentation reference:
Test date / receiving provider / restricted header evidence reference:
SPF result and alignment conclusion:
DKIM result and alignment conclusion:
Recipient DMARC result:
Unknowns / forwarding or message modification considerations:
Business delivery confirmation (separate from authentication):
Observation period and missing seasonal workflows:
Approved / not accepted / unverified:
Reviewer / date / follow-up owner / due date:

CHANGE GATES - mark demonstrated, unresolved or out of scope; cite evidence
1. Inventory owner review including seasonal streams:
2. Critical workflow recipient-side evidence:
3. Domain/subdomain configuration review:
4. Approved recovery decision and support availability:
5. Post-change authentication and business workflow checks:
6. Acceptance, unresolved items and next review date:

FOLLOW-UP
Item / evidence / owner / due / retest outcome:
Pause reason / recovery decision / communication time:
DNS caching checked before concluding recovery is effective:
New or retired service review date:

Synthetic case checks (not actual messages):
A. From example.com; SPF pass vendor.example.net; DKIM pass d=example.com:
   aligned passing DKIM path.
B. From example.com; SPF pass vendor.example.net; DKIM fail:
   no aligned passing path shown.
C. Delivered message with no trusted authentication evidence:
   alignment remains unverified.

Sources and explanation:
https://northstarit.ca/blog/dmarc-enforcement-sender-inventory/
https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configure
https://www.cyber.gc.ca/en/guidance/implementation-guidance-email-domain-protection
https://support.google.com/mail/answer/81126