How to Build a Sender Inventory for Your Domain

A sender inventory is the map of every system allowed to send email as your domain. Without that map, SPF, DKIM, and DMARC repairs turn into guesswork.

Before you change anything

• Start with real messages, not just a list of tools someone remembers using.
• Include inactive or legacy tools until headers prove they no longer send.
• Separate human mailbox senders from marketing, CRM, outbound, and transactional senders.

Step-by-step repair process

1. List every known sending tool. Include Google Workspace, Microsoft 365, CRM, marketing automation, outbound sales, support desk, ecommerce, billing, forms, and transactional systems.
2. Collect one header from each sender. The header should show the From domain, return-path, SPF result, DKIM d= domain, selector, and DMARC result.
3. Record the owner. Add who controls the tool, who controls DNS, and who can approve sender changes.
4. Classify each sender. Mark each source as active, legacy, unknown, or remove candidate.
5. Compare SPF and DKIM coverage. A sender should either pass aligned SPF or aligned DKIM before DMARC enforcement is tightened.
6. Keep the inventory with your DNS notes. Every future tool added to the stack should update the inventory before DNS is changed.

Common mistakes to avoid

• Adding every vendor include to SPF “just in case.” That can create lookup-limit failures.
• Removing a vendor because nobody remembers it, even though invoices, forms, or automations still send through it.
• Treating subdomains and root-domain senders as the same path when they use different authentication.

Related repair guides

Reference points

These are technical reference points, not a substitute for checking your real message headers and sender inventory.

• Gmail sender guidelines
• SPF standard