Proving mail is legitimate.
WHAT THE THREE MECHANISMS ARE
A record declaring which servers may send for your domain A signature added to messages, verified against a published key A policy stating what receivers should do when the others fail
WHAT THE FIRST CHECKS
The envelope sender's domain against the connecting address.
WHAT BREAKS IT
Forwarding, which changes the connecting server but not the envelope.
WHAT THE SIGNATURE CHECKS
That the message was signed by the domain and not modified.
WHY IT SURVIVES FORWARDING
It travels with the message.
WHAT THE POLICY MECHANISM ADDS
Alignment: requiring the authenticated domain to match the visible sender
Instructions: monitor, quarantine, or reject
Reporting
WHY ALIGNMENT MATTERS
Without it, a message can pass the earlier checks while displaying a forged sender.
WHAT TO PUBLISH FIRST
A policy in monitoring mode, with reporting.
WHY
The reports show what is sending as your domain, including systems you forgot.
WHAT TO DO NEXT
Fix legitimate sources, then tighten the policy gradually.
WHAT TO NEVER DO
Publish a rejecting policy before checking the reports.
WHY
Legitimate mail is rejected, and nobody notices until a customer complains.
