CertaDNS
Skip to lesson

Operating DKIM · lesson 2 of 3

What to monitor

After this lesson you can

Define checks that fail before delivery does, not after.

Assumes you have read What decays.

DKIM fails silently. Nothing bounces, no dashboard turns red, and the first human signal is usually a customer saying mail went to spam weeks after the cause. Monitoring is the difference between finding out in an hour and finding out in a quarter.

What to watch

CheckFrequencyAlert when
Each live selector resolves and returns a non-empty p=HourlyAny answer is empty, NXDOMAIN, or unparseable
The published key byte-matches the expected oneDailyIt changed and you did not change it
No live selector carries t=yDailyTesting mode appears on a production key
DKIM pass rate from aggregate reportsPer reportIt drops more than a few points week on week
Every d= in aggregate reports is one you recogniseWeeklyAn unknown signing domain appears

Resolving from outside

A check that queries your own nameserver proves the record exists there. It does not prove the record is reachable, that every secondary has it, or that the delegated far end of a CNAME still answers. Query a public resolver, and query more than one.

for r in 1.1.1.1 8.8.8.8 9.9.9.9; do
  dig +short TXT mktg202609._domainkey.example.com @$r
done

# empty output from any of them is the alert condition

The pass rate is the real signal

Everything above checks that the record is correct. Only the aggregate reports tell you whether signatures are actually verifying, and that is the number that moves when something breaks that no record check can see — a signer that stopped signing, a gateway that started rewriting, a platform that quietly switched selectors.

  • Track the DKIM pass rate per signing domain, not as one figure for the estate.
  • A drop confined to one d= points at one platform, which is most of the diagnosis.
  • A drop across all of them points at something you changed.

Alert on the record before the rate

A record check fails within the hour; a pass-rate drop needs a day of reports to become visible. Have both — the first catches the change you made this morning, the second catches everything else, including the changes nobody told you about.

Try it on a real domain

Free, no account, public DNS only.

Last reviewed