A finished programme is not finished. It is in a state that requires a small, specific amount of recurring attention, and the failure mode is that nobody is assigned to give it.
The recurring work
| Cadence | Task | Why it cannot be skipped |
|---|---|---|
| Continuous | Alerts on record drift, pass-rate drops, unknown sources, and no-reports-received | These fire on changes nobody told you about, which is most of them. |
| Weekly | Review new sending sources in the reports | A new business system is indistinguishable from spoofing until somebody looks. |
| Monthly | Confirm every domain in the estate still has the policy it should | Records get edited during incidents and not put back. |
| Quarterly | Sweep the selectors: unaccounted-for, testing mode, undersized, unrevoked | Vendors are offboarded by people with no reason to think about DNS. |
| Quarterly | Re-check the lookup count on every sending domain | A vendor grows their include and takes you over ten without touching your record. |
| Annually | Re-run the cold audit as an outsider | It catches what the monitoring was never configured to look for. |
| Per event | New domain, new vendor, vendor offboarded, acquisition | Each has a checklist, and each is where the estate drifts. |
The four events that matter most
- A new domain is registered. It enters at the strict non-sending set plus
rua, on day one, before anyone asks. - A new platform is adopted. Alignment is a question asked during selection, not after go-live. It is far cheaper as a procurement criterion than as a migration.
- A platform is dropped. Removing its selector and its SPF include is part of offboarding. If it is not on that checklist, it will not happen.
- A company is acquired. Observe for a month, classify, then treat as any other domain. The reports are also the cheapest inventory of their systems you will get.
Assign it, or it stops
Every one of those tasks takes minutes and none has a deadline, which is exactly the profile of work that does not get done. The programme needs a named owner, a recurring calendar entry, and a runbook short enough that a successor can pick it up — because the person who built it will move on, and the estate will not.
The one thing to hand over
A single document listing every domain, its policy, its senders and who owns each sender. It is the artefact the whole programme produced, it is what makes the quarterly sweep take twenty minutes instead of a week, and it is the only thing that survives a change of staff.