Email and domains

This category contains 3 automated control definitions and 5 manual checks across the sources named below. Similar controls from different standards are listed separately because names, thresholds or severity can differ. Whether the seeded Alignr Baseline is available depends on how your workspace was provisioned. Library templates are copied as disabled drafts. See Choose a baseline before enabling anything.

Automated controls

Expand a control to see the exact population, expectation and defaults. A pass requires usable evidence for the selected population. A known contrary observation can prove failure; missing observations or an empty population must not become a pass.

SPF record is present

Explanation
Definition

Each selected domain should have the expected SPF presence signal.Part of Email & domain protection.Applies toSubjects with a recorded spf record present observation.What the result tells youThis is the bounded DNS presence check, not a full validation of authorised senders or every SPF include. Complete the manual SPF review.

Setting	Value
Standard	Email & domain protection
Severity	High
Declared autonomy	Suggest only

Population conditionSPF record present (external_spf_present) has an observation.Expected evidence

SPF record present (external_spf_present) equals true.

Required predicates: external_spf_present.

{
  "match": {
    "predicate": "external_spf_present"
  },
  "expect": [
    {
      "fact": "external_spf_present",
      "op": "eq",
      "value": true
    }
  ],
  "severity": "high",
  "title": "SPF record is missing",
  "evidence": [
    "external_spf_present"
  ]
}

DMARC enforcement is enabled

Explanation
Definition

Each selected domain should have the expected DMARC enforcement signal.Part of Email & domain protection.Applies toSubjects with a recorded dmarc enforcement policy observation.What the result tells youThis checks the collected DNS enforcement signal. It does not test actual message alignment, reporting operation or every mail flow.

Setting	Value
Standard	Email & domain protection
Severity	High
Declared autonomy	Suggest only

Population conditionDMARC enforcement policy (external_dmarc_enforced) has an observation.Expected evidence

DMARC enforcement policy (external_dmarc_enforced) equals true.

Required predicates: external_dmarc_enforced.

{
  "match": {
    "predicate": "external_dmarc_enforced"
  },
  "expect": [
    {
      "fact": "external_dmarc_enforced",
      "op": "eq",
      "value": true
    }
  ],
  "severity": "high",
  "title": "DMARC enforcement is not enabled",
  "evidence": [
    "external_dmarc_enforced"
  ]
}

Mail exchange is configured

Explanation
Definition

Each selected domain should have a usable MX observation.Part of Email & domain protection.Applies toSubjects with a recorded mail routing records present observation.What the result tells youA usable MX observation does not prove mail acceptance or correct routing for every sender. Null MX does not satisfy the source check.

Setting	Value
Standard	Email & domain protection
Severity	High
Declared autonomy	Suggest only

Population conditionMail routing records present (external_mx_present) has an observation.Expected evidence

Mail routing records present (external_mx_present) equals true.

Required predicates: external_mx_present.

{
  "match": {
    "predicate": "external_mx_present"
  },
  "expect": [
    {
      "fact": "external_mx_present",
      "op": "eq",
      "value": true
    }
  ],
  "severity": "high",
  "title": "Mail exchange is missing",
  "evidence": [
    "external_mx_present"
  ]
}

Manual checks

These are human reviews, not automated evidence. The interval below is the template default; review ownership, evidence and suitability for the client.

Review SPF records

Review every 30 days · Email & domain protectionFor every sending domain, manually validate the public SPF record, authorised senders and DNS lookup budget. The automated control only proves that one SPF record is present; this review remains required for record validity, approved senders and the recursive lookup limit. Pass when the record is valid, contains only approved senders and stays within the agreed lookup budget. Fail when it is malformed, includes an unapproved sender or exceeds the lookup budget. Evidence: capture the DNS response, domain and review date.Record: who performed the review, when it was performed, the evidence, the conclusion and any follow-up or approved exception. A due review is not evidence of a completed review.

Review DKIM signing

Review every 30 days · Email & domain protectionFor every sending domain and provider, verify the published DKIM selector and send a test message where appropriate. Pass when approved outbound mail is signed and the public key validates. Fail when signing is disabled, the selector is absent or validation fails. Evidence: record the selector, provider result and a redacted test header.Record: who performed the review, when it was performed, the evidence, the conclusion and any follow-up or approved exception. A due review is not evidence of a completed review.

Review DMARC policy

Review every 30 days · Email & domain protectionInspect the public DMARC record and reporting destinations for every sending domain. Pass when an approved policy is published, aligned with the agreed enforcement level and reports go to monitored mailboxes. Fail when it is missing, set to monitoring only without an approved exception, or sends reports to an unowned destination. Evidence: capture the DNS response, policy and exception owner.Record: who performed the review, when it was performed, the evidence, the conclusion and any follow-up or approved exception. A due review is not evidence of a completed review.

Review domain registration and expiry

Review every 30 days · Email & domain protectionCompare every business domain with the registrar account and renewal register. Pass when the registrant, registrar access, renewal owner and expiry date are recorded and auto-renewal or a dated renewal task is confirmed. Fail when ownership is unclear, expiry is within the agreed renewal window, or no recovery access is held. Evidence: attach the registrar record or renewal confirmation; do not store credentials.Record: who performed the review, when it was performed, the evidence, the conclusion and any follow-up or approved exception. A due review is not evidence of a completed review.

Review public TLS certificates

Review every 30 days · Email & domain protectionInventory public HTTPS endpoints and inspect each certificate chain, hostname coverage, issuer and expiry. Pass when each approved endpoint uses a trusted, hostname-matching certificate with a documented renewal owner and more than 30 days remaining. Fail when a certificate is expired, mismatched, untrusted or has 30 days or fewer remaining; record any approved exception separately. Evidence: record the endpoint, certificate subject, issuer, expiry and inspection date. Alignr does not run an external scanner for this check.Record: who performed the review, when it was performed, the evidence, the conclusion and any follow-up or approved exception. A due review is not evidence of a completed review.

Investigate a result

Confirm the client and the account, device or other item being assessed. Check the source, observation time and effective settings, then compare the recorded evidence with the expectation. Missing evidence needs investigation; a change to the environment requires a separate review.

Next steps

Create a custom control · Parameters and client overrides · Record a manual check

Start here

Explore Alignr

Email and domains

Automated controls

Manual checks

Investigate a result

Next steps

​Automated controls

​Manual checks

​Investigate a result

​Next steps

Automated controls

Manual checks

Investigate a result

Next steps