DKIM fails silently. Nothing bounces, no dashboard turns red, and the first human signal is usually a customer saying mail went to spam weeks after the cause. Monitoring is the difference between finding out in an hour and finding out in a quarter.
What to watch
| Check | Frequency | Alert when |
|---|---|---|
| Each live selector resolves and returns a non-empty p= | Hourly | Any answer is empty, NXDOMAIN, or unparseable |
| The published key byte-matches the expected one | Daily | It changed and you did not change it |
No live selector carries t=y | Daily | Testing mode appears on a production key |
| DKIM pass rate from aggregate reports | Per report | It drops more than a few points week on week |
| Every d= in aggregate reports is one you recognise | Weekly | An unknown signing domain appears |
Resolving from outside
A check that queries your own nameserver proves the record exists there. It does not prove the record is reachable, that every secondary has it, or that the delegated far end of a CNAME still answers. Query a public resolver, and query more than one.
for r in 1.1.1.1 8.8.8.8 9.9.9.9; do dig +short TXT mktg202609._domainkey.example.com @$r done # empty output from any of them is the alert condition
The pass rate is the real signal
Everything above checks that the record is correct. Only the aggregate reports tell you whether signatures are actually verifying, and that is the number that moves when something breaks that no record check can see — a signer that stopped signing, a gateway that started rewriting, a platform that quietly switched selectors.
- Track the DKIM pass rate per signing domain, not as one figure for the estate.
- A drop confined to one
d=points at one platform, which is most of the diagnosis. - A drop across all of them points at something you changed.
Alert on the record before the rate
A record check fails within the hour; a pass-rate drop needs a day of reports to become visible. Have both — the first catches the change you made this morning, the second catches everything else, including the changes nobody told you about.