Inventory streams, not just vendors

One provider account can send password resets, invoices, support replies, and campaigns with different domains and configurations. Create one row per distinct stream. Include systems that send rarely: monitoring alerts, recruitment tools, CRM automations, help desks, survey platforms, legacy servers, and devices.

Use fields that support decisions:

Field What to capture
Purpose and audience Transactional, support, marketing, internal, or other defined use
Accountable owner Team and reachable person or role
Provider and account Exact tenant/account, not only the vendor name
Visible identity From domain and representative address
SMTP identity Return-path/MailFrom domain
DKIM Signing domain, selector, key ownership, rotation date
Volume and pattern Typical and peak ranges, seasonality
Evidence Fresh sample message and provider event
Lifecycle Approval, review date, and retirement procedure

Do not put plaintext credentials, recipient lists, or full customer messages in the inventory.

Discover the unknown senders

Interview teams, review approved vendor records and DNS, inspect representative messages, and compare aggregate authentication reports where authorized. DNS alone is incomplete: an old include can remain after a vendor is retired, while a service using a provider domain may not be obvious at the organizational domain.

Mark confidence. “Owner confirmed and fresh receiver evidence captured” is stronger than “TXT record appears related.” Keep unrecognized sources in an investigation queue; do not authorize them merely because they are already sending.

Connect the inventory to change control

Require a new or changed sender to document purpose, permission basis, domains, expected volume, SPF/DKIM setup, DMARC alignment, bounce and complaint handling, suppression synchronization, and rollback. Assign a review date. Retiring a sender should stop traffic, preserve required suppression evidence, remove credentials, and then remove obsolete DNS authorization after observation.

Validate before enforcement

Sample each legitimate stream at representative receivers. Record trusted Authentication-Results and verify the responsible owner. Investigate failures before tightening shared policy. Current provider requirements can change, so link to their official guidance and date the review rather than copying requirements into a permanent unchecked note.

The inventory is complete enough to act on when every production stream has an owner and evidence, unknown traffic has a disposition, and a proposed DNS change can be mapped to affected rows. Keep it as an operational register; a spreadsheet created once and forgotten will be least accurate when an incident occurs.