Find every legitimate sender
Include the main mail platform, business applications, website forms, billing tools and bulk-mail systems. Record the domains they use in messages and who administers each service.
Review authentication together
SPF, DKIM and DMARC address related but different parts of email authentication. Review the provider requirements and alignment for each legitimate sending service.
Start with evidence
Use authentication reports and delivery testing to identify senders and failures. Plan a staged policy change so legitimate business communications are understood before stronger enforcement.
Keep ownership clear
Document DNS changes, the reporting destination and the person who reviews new senders. Revisit the inventory when the business adopts another application or mail service.
This guide is a planning aid. The scope and design for your environment should be agreed after discovery.