Monitor your SPF and DKIM TXT records for unexpected changes
SPF, DKIM, and DMARC all live in TXT records. Overwrite one by accident — often while adding a new email tool — and mail that used to arrive fine can start bouncing or landing in spam.
A single overwritten TXT record can break authentication
SPF records are especially fragile because there can only be one per domain: adding a new sender without merging it into the existing include: list, or a DNS provider's UI replacing the record instead of appending to it, silently drops previously authorized senders. The result usually shows up as legitimate email failing SPF checks — often diagnosed only after a customer says your email went to spam. DKIM records are separate and just as easy to lose the same way, since they're TXT records too.
TXTexample.comv=spf1 include:_spf.google.com include:sendgrid.net ~all→v=spf1 include:_spf.google.com ~all
Replacing rather than merging SPF includes silently unauthorizes a sender.
How OneDollarDNS catches this
Every monitoring run queries your domain's authoritative nameservers directly and snapshots the full TXT record value. By default, each domain is checked every hour; the Frequent Monitoring add-on can drop that to 5 minutes for hosts you mark as Priority. When a TXT record's value changes, you're alerted with the exact old and new value so you can see precisely what was dropped or added.
What this doesn't do
OneDollarDNS detects when an SPF, DKIM, or DMARC TXT record's value changes — it doesn't validate that the record's syntax is correct or that it will pass a given mail provider's authentication check. For guidance on building correct records, see SPF, DKIM, and DMARC explained and what happens without an SPF record.