When SPF, DKIM or DMARC are missing or wrong, order confirmations and password resets land in spam or don’t arrive, and others may be able to send mail as you. A Domain & email monitor checks the domain’s email setup twice a day, from DNS.
Turn it on
- Open Monitors, choose New monitor and pick Domain & email.
- Enter the Domain and keep Check email authentication on.
- If you sign mail with a DKIM selector we might not know, add it under Your DKIM selectors. It is the part before
._domainkeyin the DKIM record’s name. - Tick the alert channels and choose Create monitor.
Already have a domain monitor? Edit it and turn on Check email authentication.
What is checked
- SPF lists the servers that may send as the domain: one record, ending in
~allor-all, with at most 10 DNS lookups. - DKIM signs each message. We look for keys at your mail provider’s selectors and the usual ones.
- DMARC tells receivers what to do with mail that fails:
p=noneonly watches, quarantine sends it to spam, reject refuses it. Gmail and Yahoo require it from bulk senders. - MX, where the domain receives mail.
The same check asks blocklists about the mail servers you run yourself. See how to check if your mail server is blocklisted.
When something is wrong
Each problem says what to do, with a ready-made DNS record where one fixes it. You are alerted when a new problem appears, such as a second SPF record. To see who actually sends mail as your domain, collect your DMARC reports too. More on email authentication monitoring.