Start email authentication with a list of everything that sends messages using your business domain. Then configure and test each sender before tightening your DMARC policy. Adding a DNS record without checking invoices, booking messages and newsletters can leave legitimate mail failing authentication.
The important acceptance test is whether a real message from each service passes DMARC using your domain. “It arrived in my inbox” is a different test.
What the three checks mean
SPF describes which systems may send mail for a domain used in the sending process. DKIM adds a signature that receiving systems can check using a public key. DMARC checks whether a passing SPF or DKIM result also aligns with the domain in the visible From address.
At least one of those aligned authentication routes must pass for DMARC to pass. The current DMARC standard, RFC 9989, defines that relationship. Google's DMARC guidance provides its setup instructions, including strict and relaxed alignment modes.
These checks help receiving systems assess use of your domain. They don't establish that an invoice is genuine, stop a criminal using a similar domain or make a compromised business mailbox trustworthy.
Build the sender list from business activities
Don't stop at staff email. Walk through the moments when your business sends something:
- A customer books and receives a confirmation.
- An invoice or statement leaves the accounts system.
- A website form sends a notification.
- A newsletter or recruitment service sends mail.
For each sender, note the visible From address, the service and the person who can arrange a test. Include occasional senders. A quarterly newsletter can disappear from an ordinary week's traffic.
Give the list to the authorised email administrator. They should use each service's current instructions and coordinate DNS changes. Google's SPF and DKIM instructions are useful for Google Workspace. They aren't a universal configuration for every provider.
A test that finds the missed sender
Imagine Willow Repairs, a fictional business using three services. Its administrator sends approved test messages and inspects the authentication results at the receiving system.
- Staff mail passes DMARC through aligned DKIM.
- Booking confirmations pass through an aligned authentication route.
- The newsletter has a passing DKIM signature for the newsletter supplier's separate domain, but neither SPF nor DKIM aligns with Willow's visible From domain. DMARC fails.
The third result matters even if the newsletter arrived. Willow checks the supplier's instructions for authenticating its own sending domain, completes the supported setup and repeats the test. It doesn't solve the mismatch by copying the staff-mail settings into the newsletter service.
Record the sender, test date, From domain, authentication result and any unresolved issue. Use harmless test content and approved recipients. Message headers and reports can contain addresses and other information, so keep them in an appropriate restricted location.
When is the domain ready for enforcement?
A monitoring policy, commonly called p=none, lets you gather reports without requesting quarantine or rejection because of DMARC failure. It doesn't itself ask recipients to block failing messages.
Before moving towards enforcement, check that:
- Every known business sender has produced a passing test.
- Reports cover normal activities and the occasional services on your list.
- Unexplained failures have been investigated, rather than assumed to be criminals.
- Someone can identify a delivery problem and make an authorised correction.
These are practical readiness checks, not a fixed timetable or a guarantee of delivery. Follow the provider's staged rollout guidance and account for any subdomains and forwarding arrangements relevant to your setup.
Repeat the relevant sender test when you replace the booking system, introduce a marketing tool or change email providers. Keep that test beside the service handover. It catches an authentication gap before a customer has to tell you their confirmation never arrived.