[07]Domains

DNS health monitoring

Every verified domain is re-checked every six hours for the first week, then daily. If a required record goes missing the domain moves to degraded: sending continues for 72 hours with a dashboard banner, a domain.degraded webhook and an email. If it is still missing after 72 hours the domain fails and sending from it stops.

text

verified ──(required record missing)──► degraded ──(72h unresolved)──► failed
    ▲                                      │                             │
    └──────────(records restored)──────────┴─────────────────────────────┘

This has stopped countless silent deliverability collapses caused by someone migrating DNS providers and losing DKIM in the process. Every state change is written to the audit log with the observed DNS snapshot attached, so you can see exactly what changed and when — including what the record used to be.

Failing a domain is the point

Blocking sending from a domain whose DKIM has been broken for three days feels aggressive. Continuing to send unsigned mail from it for six months, and discovering the problem from your open rate, is worse.

View this page as markdown

Adding a domain Campaign preflight