Why does the inventory come before enforcement?
An administrator can read a domain's published records without knowing which tools the business still uses. A marketing integration may be active even if nobody in IT recognizes its name. Conversely, an old record may refer to a supplier whose contract ended. Configuration and business ownership need to meet before a consequential change.
Microsoft's SPF guidance calls out the need to identify valid mail sources beyond the main mail system. The practical task is broader than naming your mailbox provider: identify the routes by which customers receive messages from your business. Source
Who should contribute to the list?
Ask operations, finance, marketing and the website owner about expected messages: receipts, reminders, password resets, form confirmations and newsletters, where used.
Include occasional workflows, such as renewals or annual events, that short observation periods can miss. Check the service list with its owners; silence does not prove a tool is unused. Do not assume one discovery source provides a complete inventory.
What belongs in each entry?
Use an appropriately restricted shared record; no new platform is needed. Name the authorized administrator, not their credentials.
- Service name and the business purpose of its messages.
- Business owner and technical contact responsible for the setup.
- Visible sending address or domain, including any subdomain.
- Normal sending pattern and any infrequent but important workflow.
- A safe representative test, its date, and authentication result.
- Current decision: keep, investigate, replace, or retire after approval.
Example only: one incomplete inventory entry
“Invoice tool; owner: finance; domain: example.com; administrator: unknown; test evidence: none; next: identify the administrator and agree a harmless test.”
This fictional entry exposes unknowns; it does not prove the sender works or authorize it. Keep passwords, payment details and client messages out.
How do you resolve an unfamiliar sender?
First ask whether someone inside the business recognizes the service and can explain its purpose. Then have the administrator compare the evidence with the supplier's supported configuration. Do not automatically authorize a source just because it appears in a report, and do not remove one merely because its technical name looks unfamiliar.
Mark unknowns with an owner and next step. A list completed by guessing cannot support a configuration decision.
How does the inventory stay useful after setup?
Make it part of adding and retiring tools. Before a new service sends customer messages, identify its owner and agree the authentication check. When a service ends, confirm that its messages have stopped and have the administrator review what can be removed. Preserve the decision record.
At handoff, name the scoped domain and services and locate their evidence. Additional services require a scope decision, not an assumed extension.