What to know
- Inventory website, billing and support senders before DNS changes.
- Test SPF and DKIM on messages from every sending platform.
- Review DMARC reports before moving to enforcement.
List every system that sends as your domain
Before changing DNS, create a sender inventory: staff mailboxes, website forms, billing software, newsletters and support tools. Our suggested worksheet records the service owner, sending domain and a representative message. Ask the finance and support teams about systems the website administrator may not see. An incomplete inventory makes it difficult to distinguish unwanted traffic from a forgotten business integration.
Authorize senders with SPF
Google’s SPF guide explains how a DNS TXT record identifies servers allowed to send for a domain. Include all legitimate providers in one SPF policy rather than publishing competing policies. Check the provider’s instructions and the SPF DNS-lookup limit before adding another include. Copying a Google-only example is inappropriate when other services also send your mail.
Verify DKIM signing for each platform
DKIM uses a message signature checked against a public key in DNS. The signing platform keeps the private key. Publish the selector supplied by that platform and verify an actual outgoing message. Our acceptance checklist includes a staff message, a website receipt and a support reply, because success from one system says little about the others.
Move DMARC from observation to enforcement
DMARC evaluates alignment with the visible From domain using SPF or DKIM and publishes handling and reporting preferences. Begin with observation while reviewing legitimate senders, then plan quarantine or rejection after correcting failures. A monitoring policy alone does not request rejection of spoofed messages. Set a report-review owner and revisit the inventory whenever a new sender is introduced.
Make the handover understandable
Deliver the final DNS record set, sender inventory and test-message results together. Document who can change each sending platform and how an urgent failure should be escalated. Authentication improves the trust signals around a message, but it does not promise inbox placement or replace account security. Pair this work with our MFA guide and preserve the records during a DNS migration. For help mapping a business email environment, contact Kiava IT services.
Sources & further reading
Primary sources supporting this article. The practical recommendations are Kiava’s general guidance and should be adapted to your project.