The modern email perimeter is larger than the mailbox provider
A single company domain can send from workplace mail, transactional APIs, marketing automation, support desks, CRMs, billing systems, monitoring platforms and physical devices. Looking only at MX records finds the inbound mailbox provider and misses much of the outbound surface. An infrastructure audit therefore begins with all ways the domain can appear in a From address.
Correlate multiple public signals
SPF includes, DKIM selectors, CNAMEs, MX records and vendor-specific DNS patterns each provide partial evidence. No single signal proves a service is actively sending. A mature inventory represents that uncertainty instead of labeling every old DNS record as live production infrastructure.
Find fragility before changing DNS
The most dangerous dependency is often not the obvious provider; it is the printer, legacy application or billing platform that nobody remembered. Look for SPF policies near their lookup budget, third-party records without an owner, forwarding paths and selectors that appear to belong to discontinued services. These are change-risk signals even when current delivery looks healthy.
Maintain a before-and-after state
An audit is most useful when it becomes a change reference. Capture the public control plane before migration or vendor removal, simulate the proposed authentication state, then scan again after propagation. That makes the audit operationally useful without requiring mailbox access.
Verify the evidence
Use the live analysis that matches this workflow instead of relying on a generic status check.