Each failure in the previous lesson has a check that catches it first. Most of them are certificate expiries, which is not a coincidence — everything on top of DMARC borrows trust from a certificate somewhere.
The checks
| Check | Frequency | Alert when |
|---|---|---|
| Policy host certificate expiry | Daily | Under 21 days. It serves one file and falls out of every renewal process. |
| Policy file fetches, parses, and matches the expected content | Hourly | Any difference. A policy edited by someone else is a policy you no longer know. |
| Every MX host appears in the policy | Hourly | A host is in MX and not in the policy — the failure that stops mail. |
| Every MX host certificate expiry | Daily | Under 21 days. |
| TLSA digest matches the key actually served | Hourly | They diverge. Catches a renewal that rotated the key. |
| DNSSEC chain validates | Hourly | It does not. For a DANE domain this is a mail outage, not a DNS one. |
| TLS-RPT reports arriving | Daily | None for 48 hours. |
| Failure counts in TLS reports | Per report | Any non-zero count, during rollout. A rising trend, thereafter. |
| VMC expiry | Weekly | Under 30 days. Renewal involves verification and is not same-day. |
| DMARC policy still at full enforcement | Hourly | It moved. BIMI depends on it and nothing links the two. |
Check the couplings, not just the records
Rows 3 and 5 are the important ones, and they are the two nobody implements. Each compares two things that are individually valid and must agree with each other:
MX set vs MTA-STS policy mx list TLSA digest vs the SPKI your MTA actually presents Both sides can be perfectly correct on their own while the pair is broken. A check that validates each record in isolation never fires.
Query from outside
- Fetch the policy over the public internet, not from inside the network that serves it.
- Resolve DNS through public resolvers, and more than one.
- Verify the certificate chain as a stranger would, including intermediates you serve but never test.
One synthetic message a day beats most of this
Send a message through your own outbound path to a mailbox at a large provider, and read the delivered headers: authentication results, the TLS version used, and whether the BIMI logo rendered. It exercises the entire chain end to end, including the couplings, and it catches things no record check can express.