An email-authentication audit is a structured check of the controls that tell receiving mail systems which messages truly represent your business. It should answer four practical questions: what sends mail as the domain, whether SPF and DKIM pass for those senders, whether DMARC aligns and applies the intended policy, and who will notice when the answer changes.
Prepare an accurate sender inventory
Start with people, not DNS. List employee mailbox providers, transactional-email services, newsletters, CRM sequences, support desks, billing platforms, forms, scheduling tools, and any agency or vendor sending as your domain. For each source, record the account owner, purpose, visible From domain, return-path if known, and whether it sends regularly or only during an event. Old trials and retired vendors are important audit findings too.
Record the current DNS state
Capture the existing SPF, DKIM, and DMARC records before changing anything. SPF normally appears as one TXT record at the root domain. DKIM records are at provider-specific selector hosts under _domainkey. DMARC is at _dmarc. Beacon’s free check gives a public starting view, but save the exact values in your audit record so later changes can be compared with evidence.
Test SPF from real messages
Send a fresh message from every major sender to a mailbox where you can view full headers. Check the SPF result and compare the return-path domain with the published authorization. A valid-looking SPF record can still omit a new service, publish duplicate records, or exceed the ten-DNS-lookup limit. See how to check SPF and the SPF lookup-limit guide for the details.
Test DKIM signatures and selectors
For each test message, find the DKIM signature’s d= signing domain and s= selector, then confirm the result says pass. Verify the matching selector resolves in DNS. A platform may sign with its own domain, which can be acceptable for some purposes but may not support DMARC alignment with your visible From domain. Review the DKIM check guide when a selector or result is unclear.
Evaluate DMARC alignment and policy
DMARC passes when SPF or DKIM passes with an identity aligned to the visible From domain. Look beyond an isolated pass/fail label: document which mechanism aligned for each sender, inspect aggregate reports if available, and identify sources that are unknown or unauthenticated. Check the policy at _dmarc, reporting destinations, percentage setting, and any subdomain policy. Our DMARC record guide explains the record components.
Classify and prioritize findings
Mark findings as urgent when a legitimate sender fails, duplicate SPF records exist, an unknown source is actively using the domain, or a strict policy could block a critical service. Mark improvements such as retiring unused authorizations, enabling DKIM, adding report ownership, or progressing from monitoring to enforcement with a clear owner and due date. Avoid changing several unrelated controls at once; it becomes impossible to know which change fixed or caused a delivery issue.
Turn the audit into an ongoing control
Repeat the key checks after a new email vendor, mailbox migration, rebrand, DNS-host move, or agency launch. Keep a small change log: date, old value, new value, reason, owner, and fresh-message test result. Email authentication is not a project you finish once; it is a reflection of the senders currently representing the business.
Use results to choose DMARC enforcement
When every legitimate sender is aligned and reports are understood, move safely from monitoring toward quarantine and reject. Do not use the desired policy as evidence that the ecosystem is ready. Read the DMARC policy comparison before enforcement.
Run Beacon’s free domain check before and after the audit to validate the public SPF, DKIM, and DMARC signals.