Domain DNS Health
Domain DNS Health automatically monitors the DNS email-authentication records — SPF, DKIM, and DMARC — of every sending domain in a channel, and alerts when a record goes missing or changes. Because these records live outside Broadcast, in your DNS provider, they can be edited or accidentally removed without warning; this feature catches that drift before it hurts deliverability.
Viewing DNS health
Open Settings → Email → Domain DNS Health within a channel. Viewing the page requires email-server read permission; using the action buttons — resetting a baseline or managing DKIM selectors — requires email-server write permission.
The page monitors the channel’s sender email domain plus any verified domains on active email servers, with one card per domain. Each card shows three rows — SPF, DKIM, and DMARC — with a status badge and the observed DNS record text for each.
A compact version of this summary also appears on each email server’s detail page, with a View details link through to the full page.
Status meanings
| Status | Badge color | Meaning |
|---|---|---|
| Healthy | Green | The record is present and matches the known-good baseline. |
| Missing | Red | No record was found in DNS. If the record was previously healthy this counts as drift and can raise an alert; a record that was never seen shows setup guidance instead. |
| Changed | Red | The record differs from the known-good baseline. |
| Unverifiable | Gray | The DNS lookup failed or timed out. This never triggers an alert. |
| Not checked | Gray | No check has run yet — or, for DKIM, Broadcast has no selectors to monitor for this domain yet. |
How and when checks run
Broadcast does direct DNS lookups on a schedule and on demand:
- Automatic checks run every 6 hours.
- Check all now, in the page header, checks every monitored domain at once and runs in the background.
- Check now, on an individual card, checks just that domain.
For SPF and DMARC, Broadcast captures a known-good baseline the first time it sees a healthy record and compares future checks against it. For DKIM, it uses the selector registered during provider setup or, if that isn’t available, probes a set of well-known selector names.
For help setting up SPF, DKIM, and DMARC records in the first place, see Domain Names.
When a record changes
If a record stays drifted — missing or changed — for 2 consecutive checks, Broadcast raises an alert:
- A red banner appears on the main Dashboard reading “Email authentication DNS records have changed,” listing the affected domains.
- The affected domain’s card shows a red Needs attention pill.
- An entry is raised in the Error Logs — critical severity for SPF or DKIM, warning severity for DMARC.
The alert resolves automatically once the record is healthy again. No email notification is sent for these alerts.
Resetting the baseline
If you intentionally change a DNS record — rotating a DKIM key, adjusting your SPF include list, and so on — the new record will be flagged as Changed until Broadcast learns it’s expected. Click Reset baseline on that domain’s card to re-accept the current DNS as the new known-good baseline, so the change stops being flagged. You’ll be asked to confirm before the reset takes effect.
Setting up DMARC
If no DMARC record has ever been seen for a domain, its card shows a recommendation rather than an alert, since there’s nothing to compare against yet. The recommendation includes a copy-to-clipboard suggested record:
v=DMARC1; p=none; rua=mailto:dmarc-reports@<your-domain>
Publishing a DMARC record is increasingly expected by mailbox providers — Gmail and Yahoo’s bulk-sender requirements are the main driver — so domains without one are worth addressing even before any alert would fire.
Manual DKIM selectors
If a domain signs its mail with a custom DKIM selector that Broadcast can’t auto-discover — typically because the email server type doesn’t support automatic domain registration — add the selector manually. On the DKIM row, use the Add DKIM selector (e.g. s1) field, which accepts letters, numbers, and hyphens; each added selector appears as a removable chip.
Note: A manual selector that has never been seen healthy still shows its status on the card, but it doesn’t trigger alerts. This keeps a typo in a selector name from generating a false alarm.
