How to document antispam decisions?

We're all familiar with the various antispam platforms and tools. The situation I find myself in is managing about a dozen domains across a few tenants, and having no idea why a given IP range was added to SPF, or as an antispam exception, or why a given sender was blocked. Looking for processes or tools to document these kinds of configurations.

Example: Domain X has 3 domains that are exempted from SPF checks, because leadership made the decision to do so after weighing the risks. When I forget about that discussion in 6 months, I want to be able to pull up a document or tool and see who made the decision and why.