Know what was checked. Keep what was found.
The Shield Record gives you and your IT provider a dated account of the agreed work and open items—not a blanket security certificate.
What belongs in the record
Scope
The domain, included sending services, agreed fee, exclusions and access arrangements.
Baseline
The date and published SPF, DMARC and MX records observed before any changes. Distinguish a successful lookup from a lookup that could not be completed.
Written approval
The exact proposed DNS changes, approver, written authorization and rollback reference. An intake request is not permission to publish a change.
Changes made
Who made each approved change, when it happened and what public DNS showed afterward.
Sender verification
Representative message evidence from the included services. Record SPF and DKIM results, whether a passing result aligns for DMARC, and any route that could not be verified.
Handoff and open items
Record delivery, owner, access status and remaining questions. Unresolved checks stay visible—not relabeled as passes.
Read the fictional sample.
example.com · Rehearsal only · No live verification
The business and senders are invented. No client delivery, live-message tests or DNS changes occurred.
Look for scope, evidence and the owner of each open item. The sample states that live alignment was not established. A real handoff should distinguish supported results from unresolved checks—not replace evidence with a reassuring label.
example.com
# Shield Record — fictional sample Example Property Group · example.com Sample date: September 9, 2026 Status: Prepared example; not delivered to a client. This file demonstrates the handoff format. The business, people, observations and results are fictional. No live domain or message was tested. No DNS was changed. Do not copy this sample into a production DNS configuration. ## 1. Agreed scope - Domain: example.com. - Example sending services: Workspace and Client CRM. - Business purpose: Employee messages and customer updates. - Boundary: This specimen demonstrates a record, not a completed paid engagement or a security certification. ## 2. Baseline - Example observation: A monitoring-only DMARC policy. - Live public-record evidence: None collected for this specimen. - Meaning: A monitoring policy does not by itself establish a breach or verify a sender. ## 3. Change and approval record - Change state: Fictional approved-change example. - Example approver: The customer's domain administrator. - Exact production DNS changes: None proposed in this specimen. - Execution: Rehearsal only; no DNS changed. - Rollback: The format calls for the prior values and a rollback reference. No live rollback action exists for this sample. ## 4. Sender checks - Workspace: Rehearsal fixture only; no live message verified. - Client CRM: Rehearsal fixture only; no live message verified. - Authentication alignment: Not established for any live sender. - Review: No independent live-sender verification is claimed by this example. ## 5. Open items - Obtain the agreed domain and sender scope before real work. - Collect authorized, non-sensitive test-message evidence. - Record actual SPF/DKIM results, DMARC alignment, test date and any unresolved route. - Assign each unresolved item to the customer's administrator or the agreed Shield reviewer. ## 6. Handoff - Delivery state: Prepared example; not delivered to a client. - Access status: No access was granted or revoked for this specimen. - Next step: Confirm scope, access arrangements and written approval before real changes. Email authentication can help reduce spoofing of an exact domain. It does not stop lookalike domains, compromised accounts, fake display names or all phishing, and it does not verify payment instructions or guarantee inbox placement.
Want the same clarity for your business domain?
Shield Setup: $750 one-time, one domain, up to three approved sending services and a dated work record. Ongoing review is separate and optional.