Get an email when your mail DNS changes.
Enter your email address and one domain. Every week we check its MX, SPF, DMARC and MTA-STS records in public DNS and email you when something changed. You also get a short report on the 1st of each month. It's free, there's no account, and every email has a one-click stop link.
- Catch a DMARC policy that was quietly set back to p=none.
- Notice an SPF include nobody on your team recognizes.
- Find out when your MX records suddenly point somewhere else.
What we watch
| Record | What it controls | Changes we email you about |
|---|---|---|
| MX | Where mail for your domain is delivered. | MX records removed, or pointing at servers you don't recognize. Whoever controls your MX records receives your mail. |
| SPF | Which servers may send mail as your domain. | The record removed or duplicated, services added or removed, the "all" policy weakened, or more than 10 DNS lookups. |
| DMARC | What receivers do with mail that fails authentication. | The record removed, the policy weakened (for example from reject to none), pct lowered, or reports sent to a new address. |
| MTA-STS | Whether senders must use verified TLS to deliver to you. | The record removed or duplicated, the policy mode weakened from enforce, or the policy updated. |
How it works
1. Confirm your email
We send one email with a confirmation link. Until you click it, we check nothing and send nothing else. Unconfirmed sign-ups are deleted after 48 hours.
2. We record a baseline
The first check, within the hour, records your current records. From then on we check once a week.
3. You hear about real changes
When a check finds a difference, we look again about an hour later. You get an email only if the change is still there, with what changed, what it means and what to do.
What it can't do
- It reads public DNS only. It can't see who made a change or why, and it can't undo one.
- Checks are weekly, so a change can take up to a week to reach you.
- A lookup that fails is treated as unknown, never as a change. Brief DNS glitches don't trigger alerts.
- DKIM isn't included, because DKIM keys live under selectors that public DNS doesn't list. Check them with the DKIM Checker.
- It doesn't filter mail. It tells you when the records that protect your mail change.
Want spam filtered as well?
iBlockSpam Protect filters inbound spam, phishing and malware at the MX level for every mailbox on your domain. Customers get the same change alerts: weekly on Protect, daily on Plus.
Want a full check right now? Run the free Email Health Check.