Separate sender identity from mailbox access
SPF, DKIM and DMARC help receivers check domain use; they do not protect a stolen mailbox login. Email security also depends on administrator permissions, MFA and recovery methods. If you are changing platforms, plan migration separately from domain authentication. Start with actual senders and representative messages instead of assuming one record solves every delivery problem.
Separate routing, authentication and access
Identify which messages fail, which system sends them and any rejection evidence. DNS routing, sender authentication, reputation and mailbox access are related but distinct problems.
- Map users and automated senders.
- Inspect routing and representative headers.
- Review account recovery separately.
- Correct and repeat receipt tests.
Route failures by mail-system layer
SPF, DKIM and DMARC address domain authentication, not guaranteed placement or every session risk. Provider licences and migrations need their own scope. Deliver tested paths, observed results and remaining exceptions.
| Problem | Evidence | Route |
|---|---|---|
| Incoming failure | MX and provider state | Routing review |
| Spam placement | Headers and sender inventory | Authentication/delivery review |
| Unknown login | Accounts and sessions | Access review |
Example: test shop receipts separately from staff mail
Staff email works but shop receipts fail. Independent sender tests show why a staff message cannot validate the shop configuration. This is an illustrative scenario, not a customer case or a promised result.