What does SPF say?
An SPF record describes which sending hosts are authorized for a domain used in the SMTP envelope. It does not authenticate the human-visible From address on its own. Adding a new mail service often requires reviewing the SPF record, while an incorrect change can affect legitimate delivery.
What does DMARC add?
DMARC connects SPF or DKIM results to the domain in the visible From address through alignment. It publishes a policy that receiving systems can use for messages that fail those checks. A monitoring policy and an enforcement policy have different effects; changing policy without knowing all legitimate senders can disrupt mail.
- Inventory services that send mail for your domain.
- Check SPF, DKIM, and DMARC configuration with your mail provider.
- Review reports and legitimate traffic before tightening policy.
What Guardian observes
Guardian checks allowlisted public email security signals for a verified domain and records changes that matter to its rules. It can flag a posture issue, but it cannot read every message, prove inbox delivery, or configure your mail provider for you.
Example: adding a new sending service
Your company starts sending receipts through a new provider. Before changing an SPF or DMARC policy, confirm which domain that provider uses for the envelope sender, whether it signs with DKIM, and whether the identifiers align with your visible From domain. A change that looks stricter can block real receipts if the sender inventory is incomplete. Test representative messages and review the provider’s setup instructions before enforcing a new policy.