Why does the inventory come before enforcement?
An administrator can read a domain's published records without knowing which tools the business still uses. A marketing integration may be active even if nobody in IT recognizes its name. Conversely, an old record may refer to a supplier whose contract ended. Configuration and business ownership need to meet before a consequential change.
Google's SPF setup guidance begins with identifying email senders. Microsoft likewise calls out cloud services and other sources beyond the main mail system. The practical task is broader than naming your mailbox provider: identify the routes by which customers receive messages from your business.
Who should contribute to the list?
Ask operations, finance, marketing, and the person responsible for the website, where those roles exist. Have each person describe the messages they expect their tools to send. Look for receipts, reminders, password resets, form confirmations, newsletters, and other messages your actual business uses.
Include occasional workflows. A service used only for renewals or an annual event can be missed during a short observation period. We recommend checking the team's service list and asking the owner directly rather than deciding that silence proves a tool is unused. No single discovery source should be treated as a complete inventory.
What belongs in each entry?
Use a simple shared record with access appropriate to the information. You do not need a new software platform to begin. Keep secrets out of the inventory; identify the authorized administrator rather than copying credentials into a spreadsheet.
- Service name and the business purpose of its messages.
- Business owner and technical contact responsible for the setup.
- Visible sending address or domain, including any subdomain.
- Normal sending pattern and any infrequent but important workflow.
- A safe representative test, its date, and authentication result.
- Current decision: keep, investigate, replace, or retire after approval.
How do you resolve an unfamiliar sender?
First ask whether someone inside the business recognizes the service and can explain its purpose. Then have the administrator compare the evidence with the supplier's supported configuration. Do not automatically authorize a source just because it appears in a report, and do not remove one merely because its technical name looks unfamiliar.
Mark unresolved entries honestly. A useful inventory can contain unknowns if each has an owner and a next step. An apparently complete list built from guesses is less useful because it encourages decisions unsupported by the business's actual sending behavior.
How does the inventory stay useful after setup?
Make it part of adding and retiring tools. Before a new service sends customer messages, identify its owner and agree the authentication check. When a service ends, confirm that its messages have stopped and have the administrator review what can be removed. Preserve the decision record.
At handoff, an owner should be able to name the scoped senders and locate their evidence. If a review covers one domain and three services, list those three explicitly. Additional services are a scope question to resolve, not an invisible extension of the original work.