An acquisition audit should establish who controls the inherited email identities, which business services depend on them and what will happen during integration. Do not begin by copying the acquirer's DNS template onto every acquired domain. Preserve working flows while identifying unmanaged authority and evidence gaps.
Map control as well as ownership
Record legal or business ownership separately from technical access. Identify registrar, DNS, mailbox, relay, signing and reporting accounts, with accountable administrators and transition plans. Record unresolved access without assuming that acquisition completion transferred every technical permission. Keep credentials and sensitive account secrets out of the audit register.
Map each service to its visible From domain, envelope domain, DKIM signing domain, source and target tenants, provider relationship and critical business event. Application mail can bypass the employee mailbox platform entirely. Include billing, password recovery, support tools, automated notices and seasonal campaigns.
Establish the authentication baseline
Capture current DNS and approved sender configurations, then compare them with trusted receiver observations. DMARC depends on successful authentication and identifier alignment, not merely a familiar provider or an SPF pass somewhere in the route. RFC 9989. DKIM key publication and the signing service are distinct dependencies that must survive any planned migration. RFC 6376.
Use aggregate reporting to discover observed source patterns, but do not treat it as a complete service inventory or proof of business approval. RFC 9990. Reconcile findings with application owners, provider account records and authorised message samples. Keep unknown senders unapproved until attribution is established.
Test the target state by service
Define representative transactions before standardisation. Record expected identifiers, authentication results and business receipt at appropriate destinations. Include normal sending, relevant forwarding or gateway paths, and the scheduled flows that matter to the business. Set recovery criteria and retain the old dependency until the approved transition is verified.
Consider a hypothetical audit of three inherited routes. Payroll has a current authorized sample with an aligned valid DKIM signature and confirmed business receipt. Campaign has a known owner but its tested sample fails both aligned authentication paths. Legacy has no current representative sample and unresolved identities. Payroll has evidence for its tested scope; campaign requires technical diagnosis, while legacy needs evidence collection. A single portfolio-wide pass would conceal those different next actions.
These are assumed findings, not executed authentication checks, real approvals or migrated tenants. The campaign result assumes all relevant SPF and valid DKIM alignment paths were examined, not merely one failing signature. Under RFC 9989 sections 4.4 and 5.3.5 either aligned authentication path can satisfy the message-level result. Separately, sections 7.4 and 8 require domains publishing p=reject to apply valid DKIM signatures and not rely solely on SPF. A passing message is not sufficient evidence for every deployment obligation.
Report decisions that integration teams can use
Separate confirmed control, observed operation, approved exceptions and unresolved findings. Name each finding's owner, impact, next action and acceptance evidence. Prioritise critical services and unmanaged authority without concealing unknowns inside an overall pass rate.
Re-run the relevant checks after tenant moves, DNS changes, signing-key changes and provider retirement. Preserve acquisition-era evidence so later incidents can distinguish inherited configuration from integration changes. Close the audit phase only with a clear statement of tested scope and remaining work; human risk acceptance and publication of an assurance claim remain separate decisions.
This inventory and review workflow is a recommended operating model. NIST SP 800-53 Rev. 5 CM-8 and CM-3 provide a general basis for accountable inventories and controlled changes; they do not prescribe these email-specific fields or confer approval. NIST control catalogue.