SPF
Sending systems
States which servers may use the envelope domain. Forwarding and DNS lookup limits require care.
Domain authentication
Make forged use of your domain easier to reject.
Begin with every legitimate sender, then move from measurement to enforcement without interrupting real mail.
DKIM
Signed messages
Connects a cryptographic signature to a domain and detects changes to signed parts of the message.
DMARC
Alignment and policy
Checks whether authenticated domains align with the visible From address and tells receivers how to handle failure.
The review begins with a sender inventory
Business domains often send through more systems than expected: employee mail, forms, support software, invoices, newsletters, scanners and vendor platforms. The review records each legitimate path and checks representative messages before recommending enforcement.
Why reject is not the first change
A strict policy published before legitimate senders are known can block invoices, support tickets, forms and newsletters. The plan moves from observation to correction and controlled enforcement, with a validation step and the exact prior DNS record kept for rollback.
What the deliverable contains
You receive the current SPF, DKIM and DMARC findings, known sender gaps, alignment examples and a staged policy plan. The plan separates the DNS change from mailbox or vendor configuration so the owner of each system knows what to correct.
What authentication cannot solve
SPF, DKIM and DMARC do not prevent display-name impersonation, lookalike domains or a compromised legitimate account. Those threats need account security, verification rules and monitoring that match the business.
Questions about domain protection
Will a DMARC reject policy stop every impersonation email?
No. It reduces unauthorized use of the protected From domain. Display names, lookalike domains and compromised real accounts need additional controls.
Do you change DNS during the review?
The review documents current records, legitimate senders and a staged plan. Any production DNS change needs an exact recovery point and rollback path.
Why can SPF pass while DMARC fails?
SPF may pass for an envelope domain that does not align with the visible From address.