Email deliverability monitoring
Outbound email fails quietly: a missing DMARC record, an SPF record that grew past the lookup limit, or a mail server that landed on a blocklist, and password resets and invoices start disappearing into spam without a single error in your logs. The mail monitor type watches the DNS and reputation posture of a sending domain on a schedule and pages when it degrades.
Create a mail monitor
Section titled “Create a mail monitor”Monitors, then Add Monitor, type Email (SPF / DMARC / Blocklists).
| Field | Notes |
|---|---|
| Domain | The domain that sends or receives mail, e.g. example.com |
| Required DMARC Policy | No minimum (report only), p=none or stronger, p=quarantine or stronger, or p=reject |
| Check interval | Default 1 hour |
| Escalation policy | Where a failure pages |
Everything else is the same as other monitors - locations, escalation
policy binding, pausing - and is described in
Monitor types. AI assistants can create
one with the create_mail_monitor tool; see the
MCP tool reference.
What each check does
Section titled “What each check does”| Check | Looks at |
|---|---|
| MX | The domain’s mail exchangers resolve and have addresses |
| SPF | The TXT record exists, parses, stays within the 10-DNS-lookup budget (following include and redirect), and does not end in +all |
| DMARC | _dmarc.<domain> exists, parses, and its policy meets the minimum you set |
| DKIM | Selector records probed across 22 common selector names plus a wildcard check |
| MTA-STS | Policy record and policy file, when published |
| TLS-RPT | Reporting record, when published |
| Blocklists | Every MX address checked against Spamhaus ZEN, SpamCop, Barracuda, PSBL, and UCEPROTECT level 1; the domain itself checked against the Spamhaus DBL |
Each finding is graded pass, info, warn, or fail, and the monitor keeps a score out of 100 with a letter grade: A+ at 95 and above, A at 85, B at 70, C at 55, D at 40, and F below that. The full report is on the monitor’s page after each check.
When it alerts
Section titled “When it alerts”The check fails - and the monitor goes through the normal down-alert path to its escalation policy - when any hard failure is present:
- no SPF record, or no DMARC record;
- SPF ending in
+all, or an SPF PermError (too many lookups, syntax); - any MX address or the domain on a blocklist;
- a DMARC policy weaker than the Required DMARC Policy you chose.
Warnings (a DKIM selector not found, no MTA-STS) lower the grade but do not page. When the failure clears on a later check, the alert resolves.
The monitor also records events, without paging, when the SPF or DMARC record changes or when a blocklist listing appears or clears, so a change made by someone else on the DNS side shows up in the timeline.
Domain monitors carry a summary
Section titled “Domain monitors carry a summary”A domain expiry monitor also surfaces MX, SPF, and DMARC presence as part of its daily registration check. Use it for a glance; use the mail monitor when the domain sends mail that matters.
Free checker
Section titled “Free checker”The same engine runs the free email deliverability checker on alertkick.com, without an account, for a one-off look before you put a monitor on the domain.