Define the expected state

For every production stream, record From domain, SPF identity and policy fingerprint, DKIM signing domain/selectors and key fingerprints, DMARC discovery/policy, provider account, and owner. Include planned rotation selectors and temporary migration overlap with expiry dates. Without this baseline, a new selector can look like an attack and an unauthorized include can look normal.

Monitor different layers separately

Check authoritative DNS for record disappearance, multiple SPF/DMARC policies, material policy/hash changes, invalid syntax, dependency failure, and key changes. Use bounded recursive checks from relevant resolvers for user-impact context.

Also monitor trusted receiver outcomes from controlled messages and aggregate provider data. DNS presence does not prove a message signed or aligned. Google notes that Postmaster data is delayed and can be absent at low volume, so it should not page as a real-time single source.

Choose actionable thresholds

Alert immediately on high-confidence events such as an unapproved DMARC policy change, active DKIM selector disappearing, SPF permanent error across repeated resolvers, or sustained aligned-authentication failure on production mail. Use warning/review events for planned selector additions, one resolver timeout, or low-volume variation.

Require persistence or multiple independent observations where waiting is safe. Add maintenance windows with an approver and expiration; never disable monitoring indefinitely during a migration.

Make the alert a runbook entry

Include affected stream/domain, expected and observed values, authoritative source, receiver evidence, UTC times, last known good, recent change, owner, impact estimate, and safe next check. Redact message addresses and never include private keys or provider credentials.

Tell the responder how to distinguish DNS publication, cache, signer configuration, and monitor failure. Include exact rollback only when it was approved with the change.

Review alert quality

Track acknowledgements, false positives, missed incidents, stale owners, and repeated exceptions. Run quarterly fixtures for removed key, malformed SPF, DMARC change, resolver outage, and monitor outage. Monitoring succeeds when a responder can verify and route the event quickly; a high alert count is not evidence of better coverage.