Order confirmations, password resets and invoices are only useful if they arrive. When SPF, DKIM or DMARC is missing or wrong, receivers trust your mail less: it lands in spam, or it is refused outright. Gmail and Yahoo require DMARC from bulk senders, and the rules keep getting stricter.
The records are set once and then forgotten. A new newsletter tool is added to SPF and pushes it past the lookup limit. Someone adds a second SPF record instead of editing the first. A DKIM key is rotated at the mail provider but never published. Nothing breaks loudly; delivery just gets worse. Email authentication monitoring catches those changes while they are still small.
What Uptimecheck checks
- MX: which servers receive mail for the domain.
- SPF: one record, ending in ~all or -all, with at most 10 DNS lookups and includes that actually exist.
- DKIM: keys at your provider’s selectors and the usual ones, plus any selectors you add, and keys too weak for receivers to accept.
- DMARC: one record with a valid policy, whether it only watches (p=none) or quarantines and rejects, and whether it asks for reports.
- MTA-STS and TLS reporting: whether senders must use encrypted connections to deliver to you.
Uptimecheck recognises common mail providers from your MX and SPF records, such as Google Workspace, Microsoft 365, Zoho Mail, Fastmail, Proton Mail, One.com, Loopia and Migadu, and looks for DKIM keys where they publish them.
Every problem with its fix
Each finding says what is wrong and what to do, worst first. Where a DNS record fixes it, you get the record ready to paste: the name, the type and the value. A domain that sends mail but has no DMARC record, for example, gets this:
- Name:
_dmarc.northwind.shop, type: TXT, value:v=DMARC1; p=none; rua=mailto:dmarc@northwind.shop
Start with p=none and read the reports. When they show only your own senders, move to p=quarantine and later p=reject, so fake mail in your name stops reaching inboxes. Each domain also gets an overall grade, so you can see at a glance which ones need work.
A typical case
Northwind adds a new email marketing tool and pastes its include into the SPF record. The record now needs 12 DNS lookups, two more than SPF allows, and receivers start failing SPF for every message. At the next check, at most 12 hours later, Uptimecheck alerts the team that SPF needs 12 lookups and fails above 10, and suggests removing senders that are no longer used. Order confirmations are back in inboxes the same day.
Part of every domain monitor
Email authentication is checked by domain monitors, alongside the registration expiry date, so there is nothing extra to set up: add the domain, and both are watched. Keep the check on even for domains that never send mail. Such a domain should say so in SPF and DMARC, or anyone can send as it, and Uptimecheck gives you those records too.
To see when a TXT record changes at all, add a DNS monitor for it as well. Our guide on detecting hijacked DNS records explains why that matters.
For agencies
Client domains are where email setups drift: a provider switch, a new form plugin, a marketing tool someone signed up for. Watch every client domain from one workspace, grouped per client project, and send the client the exact record to add instead of a vague warning. See Uptimecheck for agencies.
Alerts go to email, Slack, Microsoft Teams, Discord, Google Chat, Mattermost, Telegram, PagerDuty, ntfy, Pushover, webhooks and push notifications on every plan. Email authentication comes with every domain monitor: 10 on Start, 50 on Professional and 150 on Business.
Plans start at €9 per month billed yearly or €12 billed monthly, excl. VAT. See the pricing page, or start a 14-day free trial without a card.