Monitor the SPF, DKIM and DMARC records on your domains that affect deliverability, and get an alert when something needs attention.
DMARC/SPF/DKIM monitoring is included on the Professional plan and above. On a lower plan, you cannot add monitors, run checks, or view check history; the API answers 403 PLAN_UPGRADE_REQUIRED for those actions. Upgrade in Settings → Billing.
If you downgrade with monitors already set up, you can still view and remove them in the dashboard. Scheduled checks and alerts pause until you upgrade again.
To look at a domain's records once, on any plan or without an account, use the free DMARC, SPF and DKIM checker. It reads the same three records, plus MX, live from public DNS and says what needs fixing. It is a snapshot: it does not check again on a schedule or send alerts, which is what monitoring adds.
Email authentication explained
SPF (Sender Policy Framework)
SPF specifies which mail servers are authorized to send email for your domain.
DKIM (DomainKeys Identified Mail)
DKIM adds a digital signature to verify emails haven't been modified in transit.
DMARC (Domain-based Message Authentication)
DMARC tells receivers what to do when SPF or DKIM checks fail.
What we monitor
- SPF record validity and configuration
- A published, unrevoked DKIM key at common selector names
- DMARC policy settings
- A compliance score for the three records together
Each monitor checks its domain again once a day by default. A domain passes when SPF, DKIM and DMARC all pass and its compliance score is 80% or higher.
Alerts
You get an email, sent to the alert address you set on the monitor or, if you leave it blank, to your account's address, when:
- A domain that was passing stops passing
- A domain that was already failing gets worse than at its last alert, or than at the first check that found it failing if it has had no alert yet
A problem that has not changed does not alert again, and a record change that leaves the domain passing sends no alert. A webhook endpoint subscribed to dmarc.failure receives the same alerts. A white-label sub-account gets no alert email unless the monitor has an alert address: leaving it blank does not fall back to an account address.
To change where a monitor's alerts go, select Change beside its alert email on the DMARC monitor page in the dashboard. Changing it uses no credits. If an API key or connected app set an alert address that is not your account's own, and that key or app later ends (for example, the key is revoked or the app is disconnected), Kawaa switches the address off, and the alerts go where they go when the field is blank. The monitor says so, and you can set the address again there.
Credits
Adding a monitor runs its first check straight away and uses 5 credits, and so does each Check now. Scheduled checks use no credits.