We checked SPF, DKIM and DMARC in 45 minutes. We found a tool nobody knew could email customers.

Deliverability sounds like a marketing problem, which is why most small teams never check it until it's an operations problem: a customer says "I never got the invoice," a password reset lands in spam, a two-factor code doesn't arrive — and someone spends a day blaming the mail provider when the real issue is a DNS record nobody has read since the company was three people.

We ran a 45-minute audit on a domain that "never had email problems." It found a SaaS tool still sending as us that nobody had on any inventory, an SPF record three lookups from the 10-lookup cliff, and a DKIM key from a contractor who left last year. Here's the exact pass, so you can run it before something breaks instead of after.

The full checklist lives on our ops-notes site (canonical, free, no signup):
👉 Email Deliverability Checklist for Small Teams: SPF, DKIM & DMARC Without Breaking Mail

1. The 45-minute audit (do this today)

• Inventory every service that sends as your domain. Mail provider, billing, helpdesk, newsletter, CRM, e-sign, CI. Ask "who emailed a customer last week?" — every answer is a sender. If a tool isn't on the list, its mail is either failing or about to.
• Look up all three records in parallel, from a terminal, not a dashboard:

  dig +short TXT yourdomain.com          # SPF
  dig +short TXT _dmarc.yourdomain.com   # DMARC
  dig +short TXT s1._domainkey.yourdomain.com  # DKIM (selectors vary: google, selector1/2, k1, fm1)

• Count your SPF lookups. The limit is 10 per evaluation, and every include: counts — including the nested ones inside your vendors' includes. At 7+, pruning is a this-quarter task, not a someday task.
• Verify DKIM validates for every sender. Send yourself a test from each system and read Authentication-Results in the original headers. You want spf=pass dkim=pass dmarc=pass. Anything else is a finding.
• Check where DMARC reports go. A DMARC record with no rua= means you published a policy and then blinded yourself.

2. SPF: one record, ten lookups

Exactly one v=spf1 record per domain — duplicate records are the most common self-inflicted wound, and receivers treat them as a permanent fail. Every sender gets an include: in that one record. The 10-lookup budget is shared with your vendors (a newsletter tool can burn 5 on its own), so at 8 lookups you consolidate senders instead of adding another include. And ~all (softfail) until a month of DMARC reports proves you've found every sender — -all punishes every tool you forgot.

3. DKIM: 2048-bit, and two live selectors

Enable DKIM everywhere, not just on the mail provider — billing and helpdesk tools often ship unsigned. Use 2048-bit keys (1024-bit is brute-forceable and scored down). And run two selectors: sign with one, rotate to the second, delete the first only after a week of clean headers. Rotation without downtime is the same new-live-before-old-dead logic as secrets rotation. DKIM keys never expire, which is exactly why they never rotate — calendar it quarterly.

4. DMARC: p=none → quarantine → reject, on a schedule

1. Day 0: v=DMARC1; p=none; rua=mailto:[e-mail] — costs nothing, blocks nothing, turns on the reporting firehose. Publish it today even if you stop reading here.
2. Weeks 1–4: parse the aggregate reports. You're looking for forgotten senders, services failing alignment, and volume you don't recognize (spoofing).
3. Week 5: p=quarantine; pct=25 — a controlled burn, bumped 50 → 100 over two weeks while watching real inboxes.
4. Then: p=reject, plus sp= for subdomains — attackers love subdomains precisely because nobody configured them.

One honest exception: strict DMARC breaks old-school mailing lists and forwarders. If your customers live on lists, hold at quarantine. "Tighter" is not automatically "better."

5. The Monday-morning runbook (mail stopped arriving)

Scope the blast radius first (test to Gmail, Outlook, one small provider — and check spam folders). Diff DNS against last-known-good: what changed in 7 days? Check the blacklists — then hunt the reason you're on them (delisting without fixing the source means you're back by Thursday, and if the source is a stolen credential, that's an exposed-key incident, not a deliverability one). Check the provider's status page before touching anything. Then tell the humans early — customers forgive delivery problems, not discovering them from their own bank statement.

---

The whole discipline fits one line: your domain's right to send mail is maintained, not owned. Every new tool spends it, every DMARC report shows the balance, and the 45 minutes a quarter you spend reading both is the cheapest insurance your invoices will ever be seen.

If you want the filled-in versions — incident response plan, severity matrix, tabletop scenarios, send-ready comms templates — that's the Ops Starter Kit ($14), and launch week takes 30% off any paid kit with code **HIVE-LAUNCH30. The free one-pager (The First 30 Minutes) is the same drill in one page.

Part of the ops-notes series — free, no-tracking guides that work at 2AM.