Email Authentication (SPF/DKIM/DMARC) Monitoring

SPF, DKIM, and DMARC are all published as DNS TXT records — checking them is a dns-type monitor with dnsRecordType: "TXT" and an expected-content pattern, not a dedicated monitor type.

Availability

Available on every plan — DNS monitoring carries no extra infrastructure cost.

DMARC

DMARC lives at a fixed, predictable name (_dmarc.<yourdomain>) and — unlike SPF at the root domain — almost never shares that name with any other TXT record, which matters (see the caveat below):

curl -X POST https://api.monsphere.com/api/v1/organizations/{orgId}/monitors \
  -H "X-Api-Key: msph_live_..." -H "Content-Type: application/json" \
  -d '{
    "name": "DMARC policy still enforced",
    "type": "dns",
    "target": "_dmarc.example.com",
    "intervalSeconds": 3600,
    "timeoutSeconds": 10,
    "config": {
      "dnsRecordType": "TXT",
      "dnsExpectedValues": ["v=DMARC1; p=reject"]
    }
  }'

DKIM

Same shape, at your selector's own name — <selector>._domainkey.<yourdomain> — which is just as name-isolated as DMARC's:

{ "type": "dns", "target": "selector1._domainkey.example.com", "config": { "dnsRecordType": "TXT", "dnsExpectedValues": ["v=DKIM1"] } }

SPF — read this before setting one up

SPF is published as a TXT record at the root domain (example.com itself, not a subdomain) — a name that commonly also carries unrelated TXT records (google-site-verification=..., a Facebook or Stripe domain-verification string, and so on). The underlying DNS check requires every TXT record returned at that name to match the expected pattern, not just one of them — so monitoring root-domain SPF only works cleanly if that name has no other TXT records alongside it. Check first with dig TXT example.com; if there's more than one record, this specific check will produce false positives no matter how the expected-value pattern is written, and DMARC/DKIM monitoring (both name-isolated by design) are the safer bet.

{ "type": "dns", "target": "example.com", "config": { "dnsRecordType": "TXT", "dnsExpectedValues": ["v=spf1 include:_spf.example.com ~all"] } }

dnsExpectedValues matches as a substring, not an exact whole-record match — you don't need to quote the entire SPF string, just enough of it to be distinctive.

How it runs

Same as every other dns monitor: a Blackbox Exporter DNS probe, region-selectable, checked against a public resolver.