Guide
SPF, DKIM & DMARC Monitoring: Keep Email Deliverable
Email deliverability dies in DNS, not in inboxes. A vendor onboarding, a “harmless” TXT edit, or a selector cleanup silently breaks authentication — and you find out from bounced invoices, not from an alert. This guide covers the three records and how to keep them honest.
The three records in 60 seconds
- SPF (
v=spf1 …on the apex TXT): authorizes sending IPs/hosts. Hard limit: 10 DNS lookups — the #1 silent killer when stacking vendors. - DKIM (
selector._domainkeyTXT): public key matching the private key that signs each message. Breaks on provider migrations that rotate selectors. - DMARC (
_dmarcTXT): policy (p=none/quarantine/reject) plus report destinations. Roll out none → quarantine → reject; never start at reject.
Check yours right now
Read all three with dig
bashdig +short yourdomain.com TXT
dig +short selector1._domainkey.yourdomain.com TXT
dig +short _dmarc.yourdomain.com TXT
# Count SPF lookups (must stay ≤ 10):
dig +short yourdomain.com TXT | grep -o "include:[^ ]*\|redirect=[^ ]*" | wc -lReplace selector1 with each selector your senders use (Google: google; check your provider's docs for the rest). Missing selector = that provider's mail fails DKIM starting now.
Monitor the drift, not just the setup
Setup guides get you to green once; drift puts you back to red silently. The records change when vendors are added, marketing tools rotate, or “cleanup” deletes a TXT someone thought was unused. Diff-based DNS monitoring on these TXT records pages the change with old-vs-new values — Certack tracks them daily alongside your other records. Start free.
Never miss an expiry again
Certack monitors SSL certificates, DNS records, and domain expiry continuously and alerts you on 9 channels before anything lapses. Two sites free, no credit card required.
Related guides
How to Check SSL Certificate Expiration: Browser, OpenSSL, curl & Online
Four reliable ways to check when an SSL certificate expires — in your browser, with OpenSSL, with curl, or with a free online checker — plus what the expiry date actually means.
How Long Do SSL Certificates Last? Validity in 2026 and the Road to 47 Days
Public TLS certificates last 200 days max since March 2026, dropping to 100 days in 2027 and 47 days in 2029. What the CA/Browser Forum timeline means for renewal automation.
What Happens When an SSL Certificate Expires?
Browser warnings, failed API calls, dropped search rankings, and broken integrations — exactly what breaks when a certificate lapses, and how to recover fast.