Every SPF decision downstream of here depends on knowing what sends as your domain. Nobody has that list at the start, and the list is not obtainable by asking — the systems that matter most are the ones nobody remembers configuring.
Four sources, in order of usefulness
| Source | Finds | Blind to |
|---|---|---|
| DMARC aggregate reports | Everything that actually sent, including what nobody told you about. | Systems that sent nothing during the window. |
| The existing SPF record | What somebody once authorised. | Anything added since, and anything never added. |
| Expense records | Platforms being paid for. | Free tiers, trials, and anything on a personal card. |
| Asking around | What people remember. | Everything installed by someone who has left. |
Only the first is evidence. The other three are hypotheses to confirm against it — the record tells you what was believed, the reports tell you what happened.
Publish DMARC at p=none before you touch SPF
Two weeks of aggregate reports is the cheapest and most complete inventory available, and it costs nothing and changes no delivery. Editing an SPF record before you have it means guessing, and the thing you guess wrong about is the system nobody mentioned.
Turning an address into a sender
Reports give you source addresses. Four pieces of evidence resolve most of them, fastest first:
- The SPF domain in
auth_results. If SPF passed formail.sendplatform.example, that names the platform outright. This alone identifies most sources. - The DKIM
d=domain. Same idea, and the better signal when both are present. - Reverse DNS.
- Who owns the address range.
dig +short -x 198.51.100.25 whois 198.51.100.25 | grep -i 'orgname\|netname\|descr'
A source inside a large cloud network resolves to the cloud provider, which narrows it to "something somebody runs". When that happens the authentication domains are the only useful evidence, and if those are absent too you are asking internally.
The deliverable
A row per sender: platform, business owner, the From domain it uses, how it authenticates today, whether it aligns, what has to change, and whether that is done.
Platform Owner From domain SPF DKIM Aligns? Action Microsoft 365 IT acme.com include selector1/2 yes none Mailchimp Marketing acme.com include d=mcsv.net NO custom return-path SendGrid Engineering acme.com include CNAME s1/s2 yes none Billing vendor Finance acme.com none none NO move to txn.acme.com
This table is the actual output of the discovery phase. The DNS edits at the end are the easy part; knowing what your organisation sends is the work, and it is the artefact every later argument refers back to.