Make the inventory before changing DNS
Start a simple list of everything that sends with your domain in From. Include everyday mailboxes, website forms, transactional email, support systems and newsletters. Assign a person who can access each service’s domain-authentication settings.
| Record | Example question |
|---|---|
| Service and owner | Who can change this platform’s sending settings? |
| Visible From domain | Which domain does the recipient see? |
| Test date and route | Was this sent from the real service, not a separate mailbox? |
| SPF / DKIM identities | Which domains actually authenticated? |
| DMARC result and next step | What evidence needs investigating? |
Capture a baseline for each route
Create a fresh CheckDMARC address and send a simple message from the service you are recording. Read the authentication results and identities. If you are investigating delivery at another provider, keep the original headers from that destination as well.
A sample report helps you learn the interface, but it is fictional evidence. A real test describes one message; it is not an inventory of all mail using your domain.
Make one explainable change and compare
Record the old result, the provider instruction you followed and what setting or DNS record changed. Allow for DNS caching, then send a fresh message through the same service. Check the identities as well as the verdict.
Before tightening DMARC policy, investigate your legitimate sending routes and use aggregate reporting to understand broader activity. CheckDMARC’s individual tests do not provide that aggregate view.
Sources
Sources checked on 6 November 2026. Provider guidance can change.