Checklist · Email and domains

Email domain: SPF, DKIM and DMARC

Stops other people sending mail as you, and shows you who tries.

Owner: Email administratorTime: 1 hour, then weekly reviews

0 of 17

Find every sender

List every service that sends mail as your domain: mail platform, CRM, ticketing, marketing, HR, monitoring, the product itself.
Each sender has an owner, and unknown senders found in DMARC reports are traced.
Domains and subdomains that never send mail are listed separately.

A DMARC record exists at _dmarc with rua reports delivered to a mailbox or a tool someone reads.
Start at p=none, fix the failing legitimate senders, then move to quarantine and then reject, with a date for each step.
The sp= tag covers subdomains; non-sending domains publish p=reject.
DMARC reports are reviewed at least weekly during rollout and monthly after.

Adjust it to your environment before relying on it. A finished list shows a routine was followed; it does not guarantee nothing was missed.

14-day free trial. No credit card. Cloud or on-premises.