synkSPF: which systems may send?
SPF publishes a policy in DNS that receiving servers can check against the sending server. Inventory every legitimate service that sends for the relevant domain: employee email, invoices, support tools, and marketing systems may all need consideration.
Maintain one valid SPF record for a given domain name instead of adding a second competing SPF record when a new tool arrives. Ask the provider to help merge the authorised sources and check the lookup limits. Copying a generic example can accidentally leave out an important sender.
References: Google: set up SPF
DKIM: can this signature be checked?
DKIM adds a cryptographic signature to a message. A receiving system uses a public key published for the signing domain to check it. The DNS name includes a selector, so use the exact selector and value supplied by the sending service.
A record existing in DNS is not the same as outgoing messages being signed correctly. Send a test message through each service and inspect its authentication result. Keep the private signing key private; only publish the public DNS material your provider supplies.
References: IETF: DKIM specification
DMARC: does authentication match the From domain?
DMARC checks whether a passing SPF or DKIM result aligns with the domain in the visible From address. It also lets a domain publish a handling policy and request reports. It is not enough for a message to pass authentication for an unrelated domain.
Review all legitimate senders before moving to a stricter policy. Monitoring and report review can reveal services you forgot. A quarantine or reject request applied before legitimate mail is aligned can disrupt your own business messages.
References: IETF: DMARC specification
Use a change checklist, not a copied record
In Synk, follow the records generated for each verified domain. Public DNS checks help identify missing or unexpected values, but they cannot promise inbox placement or prove that every third-party service signs messages correctly.
Keep a short sender register with the owner of each service and a date for the last real message test. Review it when a new agency, invoicing app, or campaign tool is introduced. That routine is often more useful than a one-time green status.
- List all sending services and their business owners.
- Use the exact domain-specific records supplied by each service.
- Test authentication on actual messages from each source.
- Review reports and delivery behaviour before tightening policy.
- Recheck after changing DNS or adding a sender.