You set up SPF, DKIM and DMARC once. DNS is not a place where things stay put. Records get edited, moved and cleaned up by people who do not know what they were for, and a mistake looks like nothing until mail starts landing in spam.
What drifts
- A DNS migration that misses the
_domainkeyCNAMEs or the_dmarcrecord. - A second SPF record added by a tool or a colleague, which breaks SPF altogether.
- SPF growing past 10 lookups as you add services. See SPF flattening.
- A DMARC policy loosened during troubleshooting and never tightened.
- A deleted MX record on the MAIL FROM domain.
What a good check covers
| Check | Looks for |
|---|---|
| SPF | One record, the right include for SES, no permissive +all, lookups within the limit |
| DKIM | SES reports DKIM as verified and the CNAME records resolve |
| DMARC | A record that parses, with a policy and a report address |
| BIMI | A valid record, and DMARC at quarantine or reject |
| MAIL FROM | The domain is set in SES, with correct MX and SPF records |
Check and alert
A report you read once a month will not help, since a record can break the day after. The useful pattern is a regular check plus an alert on change: only tell me when something that passed starts failing. That keeps the noise down and the signal obvious.
Related reading
DNS monitoring is one part of email deliverability monitoring. The checks only help if you know what a good setup looks like, so start with email authentication.
Common questions
Why do records change if nobody touched them?
Usually someone did, indirectly: a DNS provider migration, a clean-up of old records, an automated tool that rewrote a TXT record, or a service that added a second SPF record.
How often should the records be checked?
Daily is enough for most senders. A broken record usually hurts over days, not minutes, so a daily check combined with an alert gives you time to fix it.