# Event email sender authentication inventory

Copy this worksheet for each event domain. Store service identifiers and DNS evidence, not credentials or attendee addresses. Authentication does not guarantee inbox delivery.

**Event / edition:** ______  **Visible From domain:** ______  **DNS owner:** ______  **Mail-policy approver:** ______  **Review date:** ______

## 1. List every sending path

| Message and purpose | Sending system / account ID | Visible From address | MAIL FROM / Return-Path domain | DKIM d= domain and selector | Business owner | Technical owner | Sample message/date | SPF / DKIM / DMARC observed result | Next action |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Ticket confirmation | [ticketing provider] | tickets@example.org | [observed domain] | [observed d= / selector] | [name] | [name] | [date] | [result] | [action] |
| Schedule or access notice | [platform] | info@example.org | [domain] | [d= / selector] | [name] | [name] | [date] | [result] | [action] |
| Marketing campaign | [platform] | news@example.org | [domain] | [d= / selector] | [name] | [name] | [date] | [result] | [action] |
| Staff or support reply | [mailbox] | help@example.org | [domain] | [d= / selector] | [name] | [name] | [date] | [result] | [action] |

Include refund and cancellation notices, forms, CRM, finance and any vendor that uses the event's From domain. If a provider sends from its own domain, record that too; do not assume it is authorized to send as yours.

## 2. Capture current DNS and provider settings

**Current SPF TXT record and owner:** ______

**SPF mechanisms and DNS-query budget reviewed by:** ______

**DKIM selectors and provider-side signing status:** ______

**DMARC record, policy, report destination and report owner:** ______

**Custom MAIL FROM, MX or bounce-domain configuration:** ______

**DNS change approver and rollback record:** ______

Check current provider instructions before combining SPF includes or changing a selector. RFC 7208 limits DNS-query-causing SPF mechanisms and modifiers; a list of authorized vendors is not itself a valid record.

## 3. Test real messages and review policy

- [ ] Send a controlled message from each actual sending path to a mailbox the team controls.
- [ ] Record visible From, MAIL FROM, DKIM d= and authentication results from the received header.
- [ ] Confirm SPF or DKIM aligns with the visible From domain for DMARC; record failures and vendor owner.
- [ ] Confirm registration and ticket notices still arrive and the reply path works.
- [ ] Compare DMARC reports with the sender inventory; classify unknown sources carefully.
- [ ] Approve any stronger DMARC policy as a separate change after legitimate senders are fixed, with a reversal owner.

**Observed sample and report evidence:** ______  **Decision / approver / date:** ______  **Next review:** ______

When a vendor leaves, check remaining refunds, support and confirmation flows before removing its records.

Sources: [Gmail sender guidelines](https://support.google.com/mail/answer/81126?hl=en), [Amazon SES DMARC documentation](https://docs.aws.amazon.com/ses/latest/dg/send-email-authentication-dmarc.html), [RFC 7208](https://datatracker.ietf.org/doc/html/rfc7208).