Nobody designs the estate they end up with. It arrives through acquisitions, regional offices that bought their own tools, and a rebrand that left the old domain live because something still points at it. This lesson is about imposing a structure on that after the fact.
Classify before you configure
Every domain you own is in exactly one of four states, and the SPF answer follows from which:
| State | Meaning | SPF |
|---|---|---|
| Primary sending | Real mail, real people, day to day. | Full record. Guard the budget. |
| Delegated sending | One platform sends, usually from a subdomain. | Narrow record naming only that platform. |
| Redirect group | Same senders as another domain. | redirect= to the shared record. |
| Non-sending | Registered, possibly hosting a site, sends no mail. | v=spf1 -all. Next lesson. |
The work is almost entirely the classification. Once a domain is in the right box its record writes itself, and the common failure is not a bad record — it is fifty domains nobody has ever sorted, all carrying a copy of the primary domain’s record because that was the easiest thing to paste.
Copying the primary record everywhere is the default mistake
It authorises eight platforms to send as a dormant brand nobody monitors, spends the budget on senders that domain has never used, and drifts the moment the primary changes. A domain that does not send should say so; a domain that sends through one platform should name one platform.
Inheriting an estate
An acquired domain arrives with a record someone else wrote, senders nobody has documented, and usually no DMARC. Do not start by editing it.
- Publish DMARC at
p=nonewith reporting first. You cannot safely change a record until you can see what the domain actually sends. Two weeks of aggregate reports costs nothing and prevents the obvious mistake. - Audit the inherited record with the procedure from module 3. Acquired records are frequently already at permerror, which means the domain has had no SPF for some time and nobody noticed.
- Classify, then converge. Most acquired domains turn out to be non-sending or single-platform once the reports are in.
- Do not consolidate onto the parent’s record reflexively. It spends your primary budget on senders that belong to a brand you may divest.
Regional domains
acme.de and acme.co.jp usually have a local platform the head office does not know about, and a local team who will find out about your change when their mail stops. Treat each as its own redirect group rather than folding it into the global record, and read its reports before tightening anything.
Keep a register
One table, one row per domain: the classification, who owns it, what sends from it, and when it was last audited. It is unglamorous and it is the artefact that makes every later decision answerable — including the one where somebody asks why a domain nobody recognises is authorising a marketing platform.