> ## Documentation Index
> Fetch the complete documentation index at: https://docs.alignr.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Email and domains

> DNS observations and the manual checks needed for broader mail protection.

This category contains **3 automated control definitions** and **5 manual checks** across the sources named below. Similar controls from different standards are listed separately because names, thresholds or severity can differ.

Whether the seeded Alignr Baseline is available depends on how your workspace was provisioned. Library templates are copied as disabled drafts. See [Choose a baseline](/controls/baselines/overview) before enabling anything.

## Automated controls

Expand a control to see the exact population, expectation and defaults. A pass requires usable evidence for the selected population. A known contrary observation can prove failure; missing observations or an empty population must not become a pass.

<AccordionGroup>
  <Accordion title="SPF record is present">
    <Tabs sync={false}>
      <Tab title="Explanation">
        Each selected domain should have the expected SPF presence signal.

        Part of **Email & domain protection**.

        **Applies to**

        Subjects with a recorded spf record present observation.

        **What the result tells you**

        This is the bounded DNS presence check, not a full validation of authorised senders or every SPF include. Complete the manual SPF review.
      </Tab>

      <Tab title="Definition">
        | Setting           | Value                     |
        | ----------------- | ------------------------- |
        | Standard          | Email & domain protection |
        | Severity          | High                      |
        | Declared autonomy | Suggest only              |

        **Population condition**

        **SPF record present** (`external_spf_present`) has an observation.

        **Expected evidence**

        * **SPF record present** (`external_spf_present`) equals `true`.

        **Required predicates:** `external_spf_present`.

        ```json theme={null}
        {
          "match": {
            "predicate": "external_spf_present"
          },
          "expect": [
            {
              "fact": "external_spf_present",
              "op": "eq",
              "value": true
            }
          ],
          "severity": "high",
          "title": "SPF record is missing",
          "evidence": [
            "external_spf_present"
          ]
        }
        ```
      </Tab>
    </Tabs>
  </Accordion>

  <Accordion title="DMARC enforcement is enabled">
    <Tabs sync={false}>
      <Tab title="Explanation">
        Each selected domain should have the expected DMARC enforcement signal.

        Part of **Email & domain protection**.

        **Applies to**

        Subjects with a recorded dmarc enforcement policy observation.

        **What the result tells you**

        This checks the collected DNS enforcement signal. It does not test actual message alignment, reporting operation or every mail flow.
      </Tab>

      <Tab title="Definition">
        | Setting           | Value                     |
        | ----------------- | ------------------------- |
        | Standard          | Email & domain protection |
        | Severity          | High                      |
        | Declared autonomy | Suggest only              |

        **Population condition**

        **DMARC enforcement policy** (`external_dmarc_enforced`) has an observation.

        **Expected evidence**

        * **DMARC enforcement policy** (`external_dmarc_enforced`) equals `true`.

        **Required predicates:** `external_dmarc_enforced`.

        ```json theme={null}
        {
          "match": {
            "predicate": "external_dmarc_enforced"
          },
          "expect": [
            {
              "fact": "external_dmarc_enforced",
              "op": "eq",
              "value": true
            }
          ],
          "severity": "high",
          "title": "DMARC enforcement is not enabled",
          "evidence": [
            "external_dmarc_enforced"
          ]
        }
        ```
      </Tab>
    </Tabs>
  </Accordion>

  <Accordion title="Mail exchange is configured">
    <Tabs sync={false}>
      <Tab title="Explanation">
        Each selected domain should have a usable MX observation.

        Part of **Email & domain protection**.

        **Applies to**

        Subjects with a recorded mail routing records present observation.

        **What the result tells you**

        A usable MX observation does not prove mail acceptance or correct routing for every sender. Null MX does not satisfy the source check.
      </Tab>

      <Tab title="Definition">
        | Setting           | Value                     |
        | ----------------- | ------------------------- |
        | Standard          | Email & domain protection |
        | Severity          | High                      |
        | Declared autonomy | Suggest only              |

        **Population condition**

        **Mail routing records present** (`external_mx_present`) has an observation.

        **Expected evidence**

        * **Mail routing records present** (`external_mx_present`) equals `true`.

        **Required predicates:** `external_mx_present`.

        ```json theme={null}
        {
          "match": {
            "predicate": "external_mx_present"
          },
          "expect": [
            {
              "fact": "external_mx_present",
              "op": "eq",
              "value": true
            }
          ],
          "severity": "high",
          "title": "Mail exchange is missing",
          "evidence": [
            "external_mx_present"
          ]
        }
        ```
      </Tab>
    </Tabs>
  </Accordion>
</AccordionGroup>

## Manual checks

These are human reviews, not automated evidence. The interval below is the template default; review ownership, evidence and suitability for the client.

<AccordionGroup>
  <Accordion title="Review SPF records">
    **Review every 30 days** · Email & domain protection

    For every sending domain, manually validate the public SPF record, authorised senders and DNS lookup budget. The automated control only proves that one SPF record is present; this review remains required for record validity, approved senders and the recursive lookup limit. Pass when the record is valid, contains only approved senders and stays within the agreed lookup budget. Fail when it is malformed, includes an unapproved sender or exceeds the lookup budget. Evidence: capture the DNS response, domain and review date.

    **Record:** who performed the review, when it was performed, the evidence, the conclusion and any follow-up or approved exception. A due review is not evidence of a completed review.
  </Accordion>

  <Accordion title="Review DKIM signing">
    **Review every 30 days** · Email & domain protection

    For every sending domain and provider, verify the published DKIM selector and send a test message where appropriate. Pass when approved outbound mail is signed and the public key validates. Fail when signing is disabled, the selector is absent or validation fails. Evidence: record the selector, provider result and a redacted test header.

    **Record:** who performed the review, when it was performed, the evidence, the conclusion and any follow-up or approved exception. A due review is not evidence of a completed review.
  </Accordion>

  <Accordion title="Review DMARC policy">
    **Review every 30 days** · Email & domain protection

    Inspect the public DMARC record and reporting destinations for every sending domain. Pass when an approved policy is published, aligned with the agreed enforcement level and reports go to monitored mailboxes. Fail when it is missing, set to monitoring only without an approved exception, or sends reports to an unowned destination. Evidence: capture the DNS response, policy and exception owner.

    **Record:** who performed the review, when it was performed, the evidence, the conclusion and any follow-up or approved exception. A due review is not evidence of a completed review.
  </Accordion>

  <Accordion title="Review domain registration and expiry">
    **Review every 30 days** · Email & domain protection

    Compare every business domain with the registrar account and renewal register. Pass when the registrant, registrar access, renewal owner and expiry date are recorded and auto-renewal or a dated renewal task is confirmed. Fail when ownership is unclear, expiry is within the agreed renewal window, or no recovery access is held. Evidence: attach the registrar record or renewal confirmation; do not store credentials.

    **Record:** who performed the review, when it was performed, the evidence, the conclusion and any follow-up or approved exception. A due review is not evidence of a completed review.
  </Accordion>

  <Accordion title="Review public TLS certificates">
    **Review every 30 days** · Email & domain protection

    Inventory public HTTPS endpoints and inspect each certificate chain, hostname coverage, issuer and expiry. Pass when each approved endpoint uses a trusted, hostname-matching certificate with a documented renewal owner and more than 30 days remaining. Fail when a certificate is expired, mismatched, untrusted or has 30 days or fewer remaining; record any approved exception separately. Evidence: record the endpoint, certificate subject, issuer, expiry and inspection date. Alignr does not run an external scanner for this check.

    **Record:** who performed the review, when it was performed, the evidence, the conclusion and any follow-up or approved exception. A due review is not evidence of a completed review.
  </Accordion>
</AccordionGroup>

## Investigate a result

Confirm the client and the account, device or other item being assessed. Check the source, observation time and effective settings, then compare the recorded evidence with the expectation. Missing evidence needs investigation; a change to the environment requires a separate review.

## Next steps

[Create a custom control](/controls/create-custom) · [Parameters and client overrides](/controls/parameters) · [Record a manual check](/controls/manual-checks)