HR systems can send messages that look like internal mail but originate from recruitment platforms, payroll suppliers and employee-service applications. The first task is to identify the organisation's actual account and owner for each route. A recognisable supplier brand is not evidence that a particular candidate email or payroll notice was authorised by the employer.
Divide ownership before changing policy
Assign recruitment notifications to the recruiting operations owner, payroll notices to the payroll service owner and employee updates to the people-operations owner. Record vendor tenant, purpose, From identity, envelope domain, DKIM signing domain and selector, reply routing and approved support contact. If a provider serves several subsidiaries, record which legal entity and domain each account is meant to use rather than treating the group as one undifferentiated sender.
The inventory should contain operational metadata, not candidate CVs, salary details or employee identifiers. Store any necessary restricted evidence under appropriate access and retention controls. Authentication debugging is not permission to copy personnel data into a general mail troubleshooting ticket.
Understand what the result means
RFC 9989 evaluates authenticated domain use. It does not prove that an offer is valid, a payroll adjustment is correct or a recruiter is authorised to make a commitment. Keep employment decisions and bank-detail changes under their own verification processes. A compromised approved account can still send authenticated misleading content.
Use trusted receiving-system results and headers to compare the visible From identity with the authenticated identity. Do not rely on a screenshot containing a supplier logo or an untrusted header inserted by the sender. Ask the supplier for its current, account-specific custom-domain procedure and retain configuration evidence without exposing credentials.
Check the employee notice without borrowing payroll evidence
Suppose candidate and payroll notices use signing domains matching their respective From domains, while employees.hr.example appears in an employee notice’s From and provider.example.net is its DKIM d= domain. Even assuming that signature verifies, it fails strict DKIM alignment. These are hypothetical identities, not signed specimens or actual cryptographic checks. A payroll result cannot close a separate employee-notice mismatch.
RFC 9989 Sections 4.4 and 5.3.5 require considering the other relevant aligned paths for a complete DMARC result. For p=reject deployment, Sections 7.4 and 8 require valid DKIM rather than SPF alone. Separately, a candidate reply may reach the wrong recruiting queue despite a passing outbound message. Verify the approved reply destination with fictional records and controlled accounts, not real applicants or personnel details.
Test the actual employee and candidate journeys
Use an approved fictional applicant and employee account in a supported test environment. Trigger an application acknowledgment, a harmless payroll notification and an employee update through their real application workflows. Confirm controlled receipt, authentication and reply routing. Check that a candidate response reaches the expected recruiting queue without exposing another applicant's details. Treat document access and content correctness as separate acceptance criteria.
If the supplier offers only its own From identity, the business owner should decide whether a clearly presented supported address meets the workflow needs. Do not forge the employer's identity through an unsupported configuration or add broad bypass rules just to make a test appear successful. Retest supported changes and document any remaining limitation.
Keep offboarding connected to sender governance
Review authorisations when an agency contract ends, a payroll provider changes or an HR administrator leaves. Confirm the successor workflow before retiring keys or DNS dependencies. Preserve a named recovery owner for time-sensitive candidate and payroll messages. Mark the route accepted only when the service owner approves the current test evidence; neither a DNS record nor an authentication pass is an employment, privacy or regulatory compliance certification.