Two kinds of check, with different latencies. Record checks catch what you did this morning within the hour. Report-derived checks catch everything else, a day late. You need both, and neither alone is monitoring.
Record checks, hourly
| Check | Alert when |
|---|---|
_dmarc resolves and parses | It does not, from any public resolver |
p matches the expected value | It moved and you did not move it |
rua is present and unchanged | A destination disappeared |
The _report._dmarc authorisations exist | One is missing — reports will silently stop |
| Every domain in the estate has a record | A domain has none |
If _dmarc is delegated by CNAME, check the resolved record. A check that reads your own zone sees a CNAME and learns nothing about the policy in force.
Report-derived checks, daily
- Aligned pass rate, per sending source. The single most useful number, and useless aggregated across the estate.
- New sources above a volume floor. Something began sending as you. It is a new business system or it is spoofing, and you want to know which this week rather than next quarter.
- Reporting receivers that went quiet. A receiver that stopped sending reports is usually an authorisation or destination problem on your side.
- Policy-override counts. Receivers record when they did not apply your policy. A rise means something — often ARC — is carrying mail your policy would otherwise have stopped.
Alert on absence, not only on badness
“No reports received for 48 hours” is the alert most setups lack, and the one that fires when a destination breaks, an authorisation record is lost or a processor contract lapses. A silent pipeline looks exactly like a healthy one.