The eight-check verification list
- Domain ownership and renewal date (WHOIS).
- DNS A / AAAA / CNAME match expected hosts.
- MX, SPF, DKIM, DMARC for the sending domain.
- SSL certificate is valid and not within 30 days of expiry.
- Sending IP isn't on a major blacklist.
- Domain reputation is clean.
- HTTP headers expose nothing sensitive.
- Customer-facing URL is reachable from outside your network.