A large domain portfolio contains more than the domains that appear in the main mail platform. Acquisitions, campaign sites, product launches and old supplier accounts create records that are easy to discover but difficult to attribute. Discovery should produce an evidence-backed inventory with explicit unknowns, not an automatically trusted list of everything containing the company name.
Start with several authorized sources
Collect approved registrar exports, DNS-zone inventories, procurement records, subsidiary registers and service-account exports. Use certificate or external observations as leads where authorized, not as proof of current ownership. Preserve the source, collection time and original identifier for each row. Normalize names for matching while retaining the original value so a data-cleaning decision can be reviewed.
Separate registration ownership, DNS operation, business use and email-sending authority. A domain can be registered by the organisation but unused for mail; an application can use a delegated subdomain operated by a supplier. RFC 1034 describes the DNS hierarchy and administrative zones, which do not necessarily align with organisational departments. DNS concepts. Record the relationship instead of forcing all findings into one owner column.
Reconcile identities without erasing uncertainty
Choose a stable internal domain identifier and attach aliases, source records and conflicts to it. Mark newly found names as investigation candidates until an accountable party confirms their relationship. A historical invoice establishes that a purchase occurred, not necessarily that registration remains active. A certificate establishes a certificate-related observation, not present administrative control or approved email use.
For each confirmed sending service, record purpose, account or tenant, business owner, criticality, visible From, envelope domain, DKIM domain, selectors, last authorized test and approval evidence. NIST CM-8 provides a general inventory and accountability basis; these email fields and reconciliation states are the operating model proposed here. NIST catalogue. Keep unsupported fields unknown rather than copying values from a similarly named domain.
Keep three discovery outcomes distinct
Suppose a hypothetical portfolio review finds three domains. For A, a current approved registrar export and DNS account record agree, and the responsible business owner confirms its use. For B, only a certificate observation is available. For C, an old purchase invoice conflicts with the current account inventory. A can be marked corroborated under this declared review rule; B needs current ownership evidence, and C needs the conflict resolved. None is automatically approved to send mail.
These assumed inputs are not supplied registrar records, executed reconciliation or real ownership determinations. Report one corroborated, one pending and one conflicting domain out of three reviewed. Ask the authorized account owner for the missing evidence before assigning control. Keep service authorization as a separate decision even when registration and DNS authority are confirmed.
Prioritize and maintain the unresolved work
Rank findings by business impact and the authority at stake: an unknown active transactional sender deserves a different response from an old promotional name with no verified use. DMARC observations can help identify sending identities, but authentication results do not establish corporate ownership or business approval. RFC 9989. Do not automatically add newly observed infrastructure to authorization records.
Publish coverage with a defined population and state how many domains are verified, conflicting, unowned or awaiting evidence. Track mergers, registrar changes, DNS transfers and service onboarding as reconciliation triggers. Preserve retired records with their disposition rather than deleting history that may explain a future observation. The portfolio becomes manageable when every confirmed asset has an accountable relationship and every unknown has a next action, not when the spreadsheet contains the largest possible number of names.