Prepare a domain for production
Inventory senders and publish baseline authentication before production volume.
Objective
Prepare a domain for sending
Ready DNS and identity signals before production volume.
Starting state
Domain(s) registered; ESP or MTA chosen; production send not yet authenticated
Prerequisites
- DNS edit rights
- ESP/MTA admin access
- List of every system that will send as the domain
Estimated time
1–2 hours
Difficulty
intermediate
Required access
- DNS
- ESP or MTA admin
Inputs
- Domain list
- Sender inventory (ESP, CRM, transactional, marketing)
- Planned From subdomain strategy
Step-by-step instructions
- Inventory sendersList every platform that will send mail for the domain, including forgotten CRMs and support tools.
- Choose identity strategyDecide organizational domain vs subdomain for marketing vs transactional streams before publishing auth.
- Publish baseline authenticationConfigure SPF and DKIM for known senders, then publish DMARC at p=none with reporting.
- Verify before volumeSend authenticated test messages and confirm SPF/DKIM/DMARC pass before any production ramp.
Verification
- Authoritative SPF/DKIM/DMARC match inventory
- Test message shows aligned authenticated results
Common mistakes
- Unknown senders still outside SPF/DKIM
- Multiple SPF records published
- Separate transactional and marketing identities at preparation time?
- Is every legacy sender identified before enforcement later?
Rollback / recovery
- Revert DNS TXT changes from backup
- Keep volume at zero until authentication passes
Expected outcome
Sending domains have a complete sender inventory and baseline SPF, DKIM, and DMARC ready for warmup.
When to escalate
- Production mail impacted unexpectedly