Your website going down is loud. Your email breaking is silent. Nothing crashes, nobody calls, your mail just stops landing in inboxes — and you find out weeks later from a customer who assumed you were ignoring them. The records that decide whether your email is trusted live in DNS, where anyone with access can edit them and nobody is watching.
The three records, in one paragraph each
SPF is a DNS text record listing which servers may send email for your domain. A receiving server checks the sender's address against it. Common failure: two SPF records on one domain (often after adding a new email tool), which receivers treat as no record. Another: exceeding ten DNS lookups inside the record, which also fails silently.
DKIM adds a cryptographic signature to each message; the public key lives in DNS under a selector name. Common failure: a provider rotates keys and the old selector is retired, or a migration leaves the selector pointing at an empty record. Mail still sends. It just isn't signed any more.
DMARC tells receivers what to do when SPF or DKIM fail — nothing (p=none), quarantine, or reject — and where to send reports. p=none is monitoring only; it protects nobody. Moving to quarantine or reject is the point of the exercise, and it is also the moment a bad SPF or DKIM record starts actively costing you mail.
Why a validity check is not enough
Most tools will tell you whether your records are valid. That is the wrong question most of the time. The record that breaks your deliverability on a Tuesday afternoon is usually still technically valid — someone added a marketing platform to SPF and pushed the lookup count over the limit; someone replaced the DKIM selector with a new one from a different provider; a DNS migration copied every record but one.
What you actually want to know is: did anything change? A record that was fine yesterday and is different today deserves a look, even if it passes every syntax check. The change is the signal.
What good monitoring looks like
- MX presence — can anyone send you mail at all.
- SPF validity — exactly one record, under the lookup limit, ending in a sensible
-allor~all. - DKIM key status per selector — present and holding an active key. Note that some providers legitimately serve empty records for retired selectors while rotating; a good check knows the difference between "rotated" and "missing".
- DMARC policy strength — flag
p=noneas a warning, not a failure, but never let it look like protection. - Blocklist status for your domain and sending addresses — and this one has a trap: many blocklists refuse queries from shared resolvers, and a refusal looks identical to "clean". A trustworthy check confirms each list is genuinely answering before believing a clean result.
- Change alerts on all of the above, and on your nameservers — a nameserver change is either a planned migration or a hijack, and you want to know either way.
How often
DNS changes happen in seconds, so a daily check is late. Every few minutes is realistic and cheap; there is no reason to be slower than your deploys.
Doing it without becoming a DNS expert
UpConduit's email-health monitor runs all of the checks above continuously and alerts on drift — records that changed, even when they are still valid. It is included on the free plan, because the people most likely to lose email quietly are the ones without a mail team.