Use this checklist at client onboarding, quarterly review, or service handover. Its purpose is to establish ownership and a repeatable maintenance process across email, the website, and the domain. Campaign operators should also complete the separate technical pre-campaign checklist.
Client and ownership record
- ☐ Record the business domain, website URL, review date, and client contact.
- ☐ Identify the registrar, DNS host, website host, and email administrator. Record responsible people rather than collecting passwords in the checklist.
- ☐ Confirm the client controls renewal and recovery contacts and has an agreed way to authorize DNS changes.
- ☐ List each service that sends email: employee mail, newsletters, CRM, invoices, support, and website forms. Give each one an owner.
Email baseline: explain findings in business terms
- ☐ SPF: confirm there is a single SPF policy at each relevant envelope-sender domain. It identifies authorized sending infrastructure. Have the technical owner check the 10 DNS-lookup limit, including nested SPF evaluation.
- ☐ DKIM: confirm each mail service signs messages successfully. Obtain its actual selector from a received message or provider instructions; do not treat one missing guessed selector as proof DKIM is absent.
- ☐ DMARC: record the policy and verify a sample message from each service passes through an aligned SPF or DKIM result. A record existing in DNS is not enough.
- ☐ Translate each finding into an action: “The invoicing service signs with an unrelated domain; the email administrator will configure aligned DKIM and send a new test.”
Evidence the technical owner can attach
dig +short TXT example.com
dig +short TXT _dmarc.example.com
dig +short TXT s1._domainkey.example.com
These are examples, not values to copy unchanged. Replace the domain and selector. Attach dated results and redacted receiving-mailbox authentication headers. DNS queries show published configuration; received-message tests show whether a sending path uses it.
Website and renewal care
- ☐ Open the public website over HTTPS and confirm the expected page loads.
- ☐ Record certificate expiry and the person responsible for renewal failures.
- ☐ Confirm domain renewal dates, auto-renew status where applicable, and an attended billing contact.
- ☐ Identify business-critical pages whose unexpected changes warrant investigation.
Turn the review into a handover
- ☐ For every issue, record evidence, impact, owner, due date, and verification method.
- ☐ Separate “observed,” “not tested,” and “fixed and retested.” Avoid labeling an entire domain secure from a green checker result.
- ☐ Agree who receives monitoring alerts and what response is included in the service agreement.
- ☐ Schedule a review after provider migrations, new senders, DNS edits, or ownership changes.
Example handover item: “Newsletter authentication passed on 4 September. Billing mail remains untested; client finance owner to provide a test by Friday.” This is more useful than a blanket pass mark.
Start with the free Beacon check and discuss monitoring when the client needs future changes surfaced. A referral does not transfer your agreed support responsibilities. Background: SPF and DMARC.