A business may send messages from an employee’s mailbox, invoicing software, a website form and a newsletter tool. When organising email, you need a list of these sources. Without it, changing domain settings may miss an important part of everyday work.
SPF, DKIM and DMARC help recipients’ servers verify the sender. Their configuration must match the services in use.
What these mechanisms do
SPF specifies which servers may send mail for the envelope sender domain being checked. This is not automatically the domain visible in the “From” field.
DKIM allows a signature covering selected parts of a message to be checked. DMARC relates successful SPF or DKIM verification to the visible sender’s domain. One correctly aligned path is enough to pass DMARC. Settings also include message handling policy and reporting. CERT Polska’s explanation of the mechanisms.
This does not encrypt the content or confirm that every request in a message is honest. Payment requests and changes to details still need their own verification.
List every sending source
For each system in use, record its name, provider, sender domain and the person managing its settings. Include:
- the owner’s and employees’ mailboxes;
- invoices and other notifications from your software;
- website forms and notifications;
- the newsletter, if the business runs one;
- other systems sending mail on its behalf.
Also check who has DNS access and can approve a change. The shared list should describe the actual setup, not just the main mailbox.
If you do not know whether a system sends messages from the business domain, ask its administrator or provider. Do not remove a setting simply because you do not recognise its name.
Agree a testing and change plan
Ask the developer to identify the documentation for the specific providers and a method for testing sending. Record the settings before the change and agree who checks the result.
CERT Polska recommends a gradual DMARC rollout. Suddenly applying a stricter policy may disrupt messages from a system you missed. Implementation guidance.
Do not copy one DNS record from a guide to every domain. Configuration must account for the business’s current settings, dependencies and tools.
A test result has a defined scope
Checking a domain alone in a tool does not verify DKIM in the same way as analysing an actual message. CERT Polska explains this in its description of Bezpieczna Poczta. What the check covers.
After the work, keep a note of what was checked, which services were tested for sending and what the result does not cover. Do not present one green result as a guarantee that every account is secure.
With CyberKlucz, email and DNS work can be included in taking over and organising a website only within the agreed scope and authorised access. For the conversation, prepare provider details and a list of sending systems, without sending passwords.
