How to monitor DNS changes over time?

DNS records don't send you a notification when something changes. That's the problem. One accidental edit, one vendor adding a new include to your SPF record, one DMARC policy quietly rolled back during a migration. And you might not find out until deliverability breaks or, worse, someone starts spoofing your domain.

Monitoring your DNS records over time means you catch those changes before they cause damage. Here's how to actually do it.

What records to watch

For email specifically, these are the four you need to monitor:

• SPF record. Watch for unauthorized includes being added or the record being overwritten
• DKIM selectors. Watch for key rotation that wasn't communicated, or selectors going missing
• DMARC policy. Watch for the policy being weakened from p=reject back to p=none (this happens more than you'd think during ESP migrations)
• MX records. Watch for changes to mail routing, which can indicate a misconfiguration or something more serious

Commercial monitoring tools

DNS Spy is purpose-built for this. It watches your DNS records, logs changes over time, and sends you an alert when something shifts. It's simple and does the job well for most senders. If you're already using Datadog, their DNS monitoring integrates with your broader infrastructure alerting. UptimeRobot also handles DNS monitoring with alerts and has a free tier that works fine for smaller setups.

DIY monitoring

If you'd rather not add another paid tool, a simple script works. Query your critical records using dig or nslookup, save the output to a log file, compare against the previous run, and alert on any difference. Even a cron job that runs nightly is better than nothing. The script doesn't have to be elegant. It just has to run consistently.

How often should you check

Daily monitoring is the right default for most senders. If you're a larger org with multiple people who have DNS access, or you've recently migrated ESPs, bump that to every few hours during the transition period. Startups with a stable setup can get away with every 48 hours, but daily is easy enough that there's no real reason to go longer.

So the goal isn't to be paranoid. It's to keep a quiet log so that if deliverability ever tanks, you can look back and see exactly when a record changed. And who changed it. That context is invaluable when you're troubleshooting.

If you're not sure whether your current SPF or DMARC records are in good shape before you start monitoring them, run them through our free checkers first. No point watching a broken record. Check your SPF record here or parse your DMARC report here. And if something already looks off, the SOS hotline is free.