Why DNS drift matters
Your email security depends on a few DNS records. They're easy to change and easy to break, often by someone who doesn't realize email depends on them.
Common causes of drift:
- A website migration. A new web host or site builder resets the domain's DNS zone, including MX records.
- Changing DNS providers. Records are copied over by hand and one is missed or mistyped.
- A new email-sending service. Someone adds a second SPF record instead of editing the existing one, which makes SPF fail.
- A new IT provider. MX records are pointed back at the mail platform directly, bypassing filtering.
- Domain renewal problems. A lapsed domain can lose its DNS entirely.
When MX records stop pointing at our filtering servers, mail can stop being filtered, often without anyone noticing.
What we check
| Record | What we look for | Why it matters |
|---|---|---|
| MX | Still points to our filtering servers, with no unexpected extra hosts | An extra or changed MX can let mail skip filtering |
| SPF | Present, a single record, valid syntax, within the 10-lookup limit | Multiple records or too many lookups cause SPF to fail (RFC 7208) |
| DMARC | Present, valid syntax, policy unchanged | A removed or weakened policy makes your domain easier to spoof (RFC 9989) |
Each check compares today's records with the baseline saved after your setup was verified.
How often
| Item | Protect | Protect Plus |
|---|---|---|
| Drift checks | Weekly | Daily |
| Drift alerts | Yes | Yes |
| Monthly owner report | No | Yes |
Daily checks on Protect Plus shorten the time between a change and you hearing about it. If your DNS is managed by several people or providers, daily checks are worth considering.
What an alert tells you
A useful alert is specific. Each one aims to answer:
- What changed: the old value and the new value, side by side.
- What it could affect: for example, "inbound mail may no longer be filtered".
- What to check next: the one action most likely to fix it.
If the change was intentional, there's nothing to do: after it's confirmed by a second check, the new value becomes your baseline.
Honest limits
- Monitoring reads public DNS. It sees what the internet sees. It can't see your DNS provider's control panel or who made a change.
- DNS caching delays things. A change may not be visible until the record's TTL expires, so a check can briefly see old values.
- A correct MX record doesn't prove mail is filtered. It shows where mail should go. Your message history shows what actually happened.
- DKIM isn't in the drift checks. DKIM selectors aren't published in a list, so we can't reliably watch every one. Use the DKIM Checker to test a known selector.
- Drift checks don't read DMARC reports. That's what DMARC monitoring does, and it's included in both plans.
Related monitoring on every plan
- DMARC monitoring collects the aggregate reports receivers send about your domain, shows who sends mail as you and whether it passes, and tells you when it's safe to tighten your policy.
- Lookalike Domain Watch checks every day for registered look-alikes of your domain, such as typos and look-alike characters, and alerts you when one appears or gets a mail server. It detects; it can't take domains down.
- Free Domain Watch is a free, no-account version of the record checks: one domain, weekly checks of public MX, SPF, DMARC and MTA-STS records, with email alerts when they change. It doesn't include filtering.
Monthly owner report (Protect Plus)
Protect Plus adds a monthly report written for the business owner, not just IT. It summarizes the month in plain English, so you can see that protection is in place without logging in.
Try the checks for free
Our free tools run the same kinds of checks on demand:
- Email Health Check, a full domain overview
- MX Lookup
- SPF Checker
- DMARC Checker
Compare plans on the pricing page.
Frequently asked questions
How often are my records checked?
Weekly on Protect and daily on Protect Plus. Each check compares your current public MX, SPF and DMARC records with the known-good baseline saved when setup was verified, and alerts you if something has changed.
Does monitoring change my DNS?
No. Monitoring only reads your public DNS records. It never edits them. When it finds a change, it explains what changed and what to check, and you decide what to do.
Is drift monitoring the same as DMARC report monitoring?
No. Drift monitoring checks that your DMARC record exists, is valid and hasn't changed. DMARC monitoring is a separate feature on both plans: add rua=mailto:dmarc@iblockspam.com to your record and we collect the aggregate reports receivers send, show who sends as your domain and what passes, and keep parsed reports for 13 months.
What if a change was intentional?
Then there is nothing to do: once the change is confirmed by a second check, the new value becomes the baseline for future checks. Alerts make sure changes are noticed; they never stop you making them.
Related guides
How to fix SPF PermError: too many DNS lookups
Why SPF breaks at 10 DNS lookups, how to count them, and step-by-step fixes for Microsoft 365 and Google Workspace domains with many senders.
8 min read SPF, DKIM & DMARCMoving DMARC from p=none to p=reject: a staged rollout for small businesses
A staged plan to move DMARC from monitoring to reject without blocking your own mail, including what changes when a filtering gateway sits in front.
9 min read Email security basicsWhat is an MX record?
What an MX record is, how priority values pick the server that gets your mail, why backup MX can bypass a spam filter, and how to check your own records.
8 min readLast updated: