PDF · one payment · not a subscription

A working checklist for a company that sends mail from its own domain. You check a box when you have seen the evidence: a DNS record, an admin setting, or a header on a message you just sent.

It is a PDF, paid once. It does not log into the mail host, store a domain, or watch DNS the next day. The free checker on this site is a separate, point-in-time lookup.

1. Part 01

   List every system that sends mail as the domain, before touching DNS.

2. Part 02

   Publish one SPF record, then take it from soft fail to hard fail.

3. Part 03

   Turn on DKIM at each sender and prove it with a new message.

4. Part 04

   Roll DMARC from monitor mode to quarantine, then reject.

5. Part 05

   Require MFA on mail, and on the registrar and DNS host.

6. Part 06

   Find forwarding and hide-the-mail rules, including the tenant-wide ones.

7. Part 07

   Set the rule for payment-detail changes, and a place to report a suspicious message.

8. Part 08

   Back up the mailboxes and restore one, so retention is not mistaken for a backup.

9. Part 09

   Offboard a person the day they leave, including DNS access.