The same domain can appear in many technical observations, but that does not mean every observation belongs to the same customer workflow. Route alerts using verified tenant identity, service ownership and business impact. Keep ambiguous findings in internal triage rather than guessing a customer recipient.
Build an authoritative routing register
For each managed service, retain tenant, domain, business purpose, application owner, operational team, approved destination, coverage hours and backup contact. Record who approved the mapping and when it was last verified. A domain suffix or sender IP alone cannot establish the customer entitled to receive an incident.
Bind event processing to the authenticated customer context before reading the event's domain. An incoming field must not be able to override tenant identity. Match the domain and service within that boundary. Unknown or conflicting mappings should fail into a restricted internal queue with an accountable resolver, not a global customer channel.
Translate observations into impact
RFC 9989 defines alignment and DMARC processing; RFC 9990 supplies aggregate-report observations. Neither tells you whether a failure affects payroll, invoices or a dormant campaign. Join the finding to the service register before assigning urgency. Preserve confidence and report coverage alongside the impact assessment.
A large count from an unknown source may require investigation without proving a business outage. A small number of failures from a known critical service may warrant faster attention. Avoid equating p=reject with complete control coverage or treating missing reports as proof of recovery. Use service consequences and evidence quality together.
Apply ordered routing decisions
First verify tenant scope. Next resolve domain and service ownership. Then assess business impact, coverage and confidence. Finally select the authorized team and notification route. Keep a fallback for missing ownership, out-of-hours critical events and failed delivery. Each fallback needs an owner and an explicit data-sharing boundary.
Version the rule set and retain the decision inputs with each alert. This makes it possible to explain why yesterday's event reached finance operations while today's event went to triage. Do not silently rewrite historical routing decisions after ownership changes. Re-evaluate open incidents deliberately and preserve the earlier assignment history.
Resolve a same-domain ownership conflict
Suppose a verified event for tenant A names a domain also present in tenant B’s billing register, but tenant A has no approved service mapping for it. Do not borrow tenant B’s finance contact or send evidence to its customer channel. Keep the item in restricted internal triage with an owner who can resolve the missing authority. The matching domain string is a lookup clue, not a cross-customer grant.
In another hypothetical case, two authorized services share a domain: payroll needs urgent review while a dormant campaign has an attribution question. The service identity and business consequence distinguish the route; domain-only matching cannot make that decision. Test stale ownership, revoked contacts, duplicate events and concurrent mapping changes in the actual system. No routing engine, external notification or isolation test was executed here.
Review outcomes and ownership gaps
Measure time to an accountable owner, unresolved mapping age, critical alerts without acknowledgment and routing corrections. State the covered population and observation period rather than offering a single compliance percentage. A closed ticket or acknowledged alert is not itself evidence that the underlying mail flow recovered.
Review the register when customers, domains, applications, contacts or coverage arrangements change. Keep the control statement narrow: routing worked for the tested inputs under the recorded configuration. Broader compliance, delivery and product-capability claims require additional evidence.
Link the decision to its eventual outcome
Retain the finding, trusted tenant context, service match, evidence references, rule revision and chosen owner. When a remediation is proposed, link it to that decision and record the authorized verification that supports closure. An unresolved marketing attribution question can remain open while a separately verified payroll repair closes; one result must not silently close the other. These are recommended records and hypothetical states, not supplied remediation receipts or live retests.
OWASP’s multi-tenant guidance supports deriving tenant context from trusted identity, validating resource access and keeping asynchronous work scoped. The routing register adds business responsibility; it does not replace those access controls.