SPF, DKIM, and DMARC monitoring for domain email health

Authentication records are DNS contracts

SPF TXT records list authorized senders for your domain. DKIM publishes public keys verifying message signatures. DMARC defines policy when SPF or DKIM fail — none, quarantine, reject. Marketing adds SendGrid, product adds Intercom, finance adds Bill.com — each needs SPF include or DKIM CNAME. Ten includes later you exceed SPF ten-lookup limit and everything fails authentication unpredictably.

DNS Propagation Checker on TXT records at apex and _dmarc after every new email vendor onboarding.

SPF lookup limit and flattening

SPF permits maximum ten DNS lookups — nested includes count. Monitor SPF record length and lookup count with validation tools during vendor additions. SPF flattening services add dependency — monitor their uptime too.

Overlong SPF TXT records truncate at 255 bytes per string — split correctly or authentication silently breaks.

DKIM selector rotation

DKIM uses selectors — s1._domainkey.example.com TXT records. Providers rotate selectors during key rotation — both old and new must publish during transition. Monitor all active selector TXT records weekly.

Missing DKIM after DNS migration sends transactional mail to spam — Uptime Monitor on web does not detect this; DNS monitoring does.

DMARC aggregate and forensic reports

DMARC rua reports show authentication failures — review weekly for spoofing attempts and legitimate senders failing alignment. Sudden spike in failures after DNS change indicates misconfiguration not attack.

p=reject policies require confident SPF/DKIM before enforcement — monitor in p=none reporting mode first.

Subdomain policies and SPF inheritance

Subdomains do not inherit parent SPF — mail.example.com needs own SPF or explicit spf record. DMARC policy on _dmarc.example.com may differ from parent — document per subdomain mail strategy.

See subdomain monitoring guide for comprehensive subdomain DNS inventory.

Third-party sending on your domain

HubSpot, Marketo, and Zendesk send as your domain — each requires DKIM CNAME verification in DNS. Failed verification does not block web but destroys deliverability. Re-verify after DNS provider migration.

DNS Propagation Checker on vendor-provided CNAME targets confirms delegation intact — dangling CNAME enables takeover sending spam as your brand.

Monitoring checklist for 2026

Weekly: SPF, DKIM selectors, DMARC TXT via propagation checker. On vendor add: validate before production send. Quarterly: SPF lookup audit, remove deprecated includes. Pair with MX monitoring for complete email DNS health. all free monitoring tools for accessible DNS verification without dig expertise.

Aggregate reports and third-party sender drift

DMARC aggregate reports reveal SPF and DKIM alignment failures weeks before blacklist inclusion — parse reports automatically for new sending sources and unexpected IP ranges. Marketing teams add Mailchimp, Intercom, and HubSpot without updating SPF includes — gradual deliverability decline invisible to website uptime monitors.

DKIM selector rotation requires dual-selector publication before cutover — monitor both selectors during rotation window. DNS Propagation Checker on TXT records at selector._domainkey after every email platform change.

SPF ten-lookup limit causes permanent fail on long include chains — audit SPF record length when adding vendors. Domain Expiry Checker on domains referenced in SPF includes — expired include domain breaks your SPF without any change to your zone. DMARC p=reject without monitoring quarantine reports first causes legitimate mail loss during misconfiguration.

Pre-launch and quarterly review checklist

Parse DMARC aggregate reports automatically for new sending sources — marketing teams add vendors without updating SPF includes, causing gradual deliverability decline invisible to website monitors. DNS Propagation Checker on TXT records after every email platform change.

Audit SPF ten-lookup limit when adding vendors — long include chains cause permanent fail. Monitor DKIM selector rotation windows with both old and new selectors published simultaneously before cutover.

Advance DMARC policy from none to quarantine to reject only after weeks of clean aggregate reports. Domain Expiry Checker on domains in SPF includes — expired include domain breaks your SPF without any local zone change.

Reliability habits that compound

Teams that treat external verification as a release gate recover faster than teams that treat monitoring as insurance purchased once and forgotten. Assign ownership for every monitor URL, review alert noise monthly, and delete checks for decommissioned hostnames before they erode on-call trust. Website Down Checker snapshots during triage provide evidence for post-incident timelines and vendor escalations when providers dispute impact scope.

Free tools remove budget as an excuse for skipping customer-visible layers. Bookmark Uptime Monitor, Ping Test, and all free monitoring tools before launch week — not during the incident when every minute of downtime carries revenue and reputation cost. Consistency beats perfection: weekly five-minute reviews catch configuration drift that expensive suites miss when nobody logs into dashboards regularly.

Train support staff to request external confirmation before escalating to engineering — local DNS, VPN split tunneling, and corporate proxies generate false user reports daily. Engineers should resist dismissing customer reports because internal checks pass from office networks while CDN or regional failures affect users globally. Shared verification links resolve most tickets in minutes without waking on-call for non-incidents.

Incident communication and evidence collection

During confirmed outages, capture Website Down Checker and HTTP Header Checker snapshots before making changes — timestamps and status codes anchor post-incident timelines when vendors dispute impact. Update Status Page with honest customer-facing language even when root cause remains under investigation; silence erodes trust faster than temporary unavailability.

After recovery, rerun external checks from Uptime Monitor and Ping Test to confirm latency and status codes returned to baseline — not merely that one office browser loads the homepage. Assign one action owner per follow-up item from retrospectives; unowned monitor gaps guarantee repeat failures on the same blind spot.

Explore all free monitoring tools quarterly as a team drill — habits beat heroic incident response. SSL Checker and Domain Expiry Checker belong on the same calendar as application deploy reviews because TLS and registrar failures bypass application health entirely until they suddenly do not.

Incident communication and evidence collection

During confirmed outages, capture Website Down Checker and HTTP Header Checker snapshots before making changes — timestamps and status codes anchor post-incident timelines when vendors dispute impact. Update Status Page with honest customer-facing language even when root cause remains under investigation; silence erodes trust faster than temporary unavailability.

After recovery, rerun external checks from Uptime Monitor and Ping Test to confirm latency and status codes returned to baseline — not merely that one office browser loads the homepage. Assign one action owner per follow-up item from retrospectives; unowned monitor gaps guarantee repeat failures on the same blind spot.

Explore all free monitoring tools quarterly as a team drill — habits beat heroic incident response. SSL Checker and Domain Expiry Checker belong on the same calendar as application deploy reviews because TLS and registrar failures bypass application health entirely until they suddenly do not.

Frequently asked questions

How do I verify spf, dkim, and dmarc monitoring for domains in 2026 without expensive monitoring software?

Qikot provides free on-demand checks from our remote servers — no account or agent install. Use the DNS Propagation Checker linked in this article, then confirm with related tools for SSL, DNS, or headers when symptoms persist.

Are Qikot checks accurate for website operators?

Checks simulate public HTTP paths customers use. They complement — not replace — internal metrics. External failure with internal green usually means DNS, CDN, TLS, or WAF issues between your origin and the internet.

How often should website operators run these checks?

Run tier-one URLs after every deploy and DNS change. Schedule weekly uptime and ping baselines, monthly SSL and domain expiry reviews, and always verify externally during incidents before closing tickets.

Does Qikot store my URLs or require login?

No user database. Checks are stateless and results cache briefly for performance. Do not submit secrets in URLs; use health endpoints without credentials in query strings.

What should I do when a check reports down?

Capture status code and timestamp, run complementary checks (headers, DNS, SSL), update your status page if customers are affected, and escalate to hosting with external evidence rather than browser screenshots alone.