Monitoring email infrastructure for silent breakage

The expensive deliverability failures are not campaigns that underperform. They are a DKIM CNAME someone removed during a DNS migration, an SPF record that crossed the 10-lookup limit when IT added a new vendor, or a blocklisting that sat unnoticed for nine days. None of those produce an alert by default. All of them are cheap to monitor.

Monitor continuously

1. The authentication records themselves. Query and diff them on a schedule, per sending domain and subdomain:

• SPF: still a single TXT record, still resolving within 10 DNS lookups, still containing every sender you use.
• DKIM: the selector your mail actually signs with still resolves and still returns a key. Note that a platform managing keys behind CNAMEs can rotate the target — so check that the CNAME resolves, not just that it exists.
• DMARC: present, policy unchanged, rua= pointing at a mailbox someone reads. Watch sp= too, because subdomain policy is what applies to your sending subdomains.

Alert on any change you did not make. A diff is more useful than a validity check: a record can be valid and wrong.

2. Blocklist status for every sending domain and owned IP. Daily is enough. Two practical notes: keep the list of lists current — SORBS was shut down in June 2024, so anything still reporting it is reporting noise, while Validity's Heatwave blocklist launched on 3 September 2026 and is new enough that teams are seeing first-time listings. And check the domain, not only the IP; domain listings are increasingly what bites.

3. DMARC aggregate reports. Collect and parse them rather than letting them pile up in a mailbox. They are the only place you discover that a forgotten tool, or someone else entirely, is sending as your domain.

4. Deferral and rejection mix. From your ESP's event stream or your MTA logs, with the receiver's raw SMTP string kept intact. Alert on a new recurring string, not on a rate: 550 5.7.1 appearing from one provider for the first time is a signal long before any percentage moves.

5. Mailbox liveness. For mailbox-based sending, an expired OAuth grant or a changed password removes a sender silently. A 535 5.7.8 or an invalid_grant should page someone, because the mailbox simply stops and the dashboard still looks calm.

Check on demand, at least monthly

• Reverse DNS and HELO for IPs you own — the PTR should resolve and match the name the server announces.
• TLS: inbound and outbound. If you publish MTA-STS and TLS-RPT, read the reports; if you do not, at least confirm your MX hosts negotiate TLS.
• MX records for the sending domain. A domain used only for sending still needs to receive bounces and replies; a domain with no MX looks disposable and cannot process a reply.
• Domain and certificate expiry for the sending domain, the tracking subdomain and anything in your links. An expired tracking domain turns every link in every sent message into a dead end.
• Postmaster Tools and SNDS enrolment for new domains and IPs. Enrol a domain the day you start using it; the charts need history before they are useful.

Alert thresholds worth setting

Keep a change log beside the monitoring

Nearly every placement drop traces to one of four changes in the preceding week: a DNS edit, a template or tracking change, a list import, or a volume jump. If you record those four things with timestamps, correlation takes a minute. Without it, you will spend days theorising about content.

What not to do

• Do not monitor only the apex domain. Your sending subdomains are separate identities with separate records and separate reputations.
• Do not alert on aggregate rates alone. Rates move slowly; strings and record diffs move immediately.
• Do not point DMARC rua= at an unmonitored mailbox. An unread report is not monitoring.
• Do not keep a blocklist checker that queries dead lists. It manufactures false confidence and false alarms in equal measure.
• Do not let monitoring replace the weekly human review. Automation catches breakage; judgement catches drift.

MailPilot handles the parts of this that are measurement: automatic SPF, DKIM and DMARC checks per sending domain, daily per-mailbox reputation tracking, and real per-provider inbox placement through a seed-inbox network, for mailboxes connected over OAuth (Gmail, Outlook) or SMTP and IMAP (SendGrid, Amazon SES, Mailgun, Postmark, custom SMTP).