DNS Monitoring

MailShield checks your domain's DNS records and mail servers every 2 hours, so you know when your email security configuration changes or breaks.

What We Monitor

MX Records

Mail exchanger records define which servers receive email for your domain.

Checks performed:

• Valid MX records exist
• Mail servers are reachable and accept mail (using the test mailbox you set for receiving domains)
• STARTTLS support on each server
• Each server's TLS certificate: host name match, trusted chain, expiry
• DANE/TLSA records for each MX host, and whether they match the served certificate

Example MX record:

example.com.  IN  MX  10 mail.example.com.

SPF Records

Sender Policy Framework specifies authorized email senders.

Checks performed:

• Valid SPF syntax (v=spf1)
• Mechanism validation (ip4, ip6, include, a, mx)
• All-policy presence and strength
• DNS lookup count (max 10 per RFC)
• Include tree expansion
• Provider detection

Example SPF record:

v=spf1 include:_spf.google.com include:sendgrid.net -all

DKIM Records

DomainKeys Identified Mail provides cryptographic email signing.

Checks performed:

• Selector existence and validity
• Key type (RSA, Ed25519)
• Key strength (recommends ≥2048 bits)
• Record syntax validation
• Multiple selector support

Example DKIM record:

selector._domainkey.example.com.  IN  TXT  "v=DKIM1; k=rsa; p=MIIBIjAN..."

DMARC Records

Domain-based Message Authentication unifies SPF and DKIM.

Checks performed:

• Valid DMARC syntax (v=DMARC1)
• Policy strength (none, quarantine, reject)
• Alignment modes (relaxed, strict)
• Reporting configuration (rua, ruf)
• Subdomain policy (sp)
• Percentage (pct)

Example DMARC record:

_dmarc.example.com.  IN  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"

MTA-STS

Mail Transfer Agent Strict Transport Security enforces TLS.

Checks performed:

• DNS TXT record at _mta-sts.domain
• Policy file at https://mta-sts.domain/.well-known/mta-sts.txt
• Mode (testing, enforce)
• MX host list
• Max age setting

TLS-RPT

TLS Reporting enables TLS failure notifications.

Checks performed:

• Valid record at _smtp._tls.domain
• Reporting URI validation
• Version tag presence

Example TLS-RPT record:

_smtp._tls.example.com.  IN  TXT  "v=TLSRPTv1; rua=mailto:tls@example.com"

BIMI

Brand Indicators for Message Identification displays logos.

Checks performed:

• Valid record at default._bimi.domain
• Logo URL accessibility
• Logo format validation
• VMC certificate expiry, if you publish one

DNSSEC

DNS Security Extensions authenticates DNS responses.

Checks performed:

• DNSSEC enabled for domain
• Chain validation (root → TLD → domain)
• Key and signature validity

Monitoring Frequency

Trigger	Timing
Automatic	Every 2 hours
Manual	When you click Run Checks in the domain header

After you change DNS, click Run Checks to see the result right away instead of waiting for the next scheduled check.

Check Results

Each check on a domain's Overview shows one of these statuses:

Status	Meaning
Pass	Configured correctly
Attention	Works, but something should be improved, such as DMARC without MailShield reporting or an MTA-STS record whose policy doesn't validate
Fail	Missing or invalid
N/A	Doesn't apply to the domain's usage type, such as DKIM on a receive-only domain
Not checked	No result yet

Detailed Check Information

For each check, MailShield provides:

1. Raw Record: The actual DNS response
2. Parsed Fields: Structured breakdown of the record
3. Validation Results: Specific issues found
4. Recommendations: How to fix problems
5. Best Practices: Tips for improvement

Change Detection

After each check, scheduled or started with Run Checks, MailShield compares the results with the previous check. When a record changes, it raises a DNS changes alert that shows what changed. The first time a check finds a problem that breaks a record, such as two DMARC records, you get an alert about that too. See Alerts.

Provider Detection

MailShield recognizes common email providers in your SPF includes, such as Google Workspace, Microsoft 365, Amazon SES, SendGrid and Mailchimp, so you can see which services are authorized to send for your domain. For how to set up each provider, see Third-Party Senders.