Twelve Domains, Five Broken: How Cold Email Fleets Drift and How to Audit Them

A fleet of twelve sending domains, set up over three months by two people following the same checklist, is never actually twelve copies of the same thing. It is twelve snapshots of a checklist that changed while they were working through it. This is the audit I run on every fleet I take over, what it finds, and the graphic that makes the problem obvious in a way twelve individual checks never do.

matches reference · differs · missing or wrong

Why fleets drift

Three mechanisms, and they all look like nothing at the time. The template moved. DMARC went from p=none to p=reject in April; the domains registered in March still say none. A vendor changed. The SPF include for a tool that was dropped in June is still in eight of the records, and the tool that replaced it is in four. Different hands. One domain was bought at a different registrar during a sale, so it sits on different nameservers, and every DNS change since has been made in one place and not the other. None of these produces an error. Each domain, checked on its own, passes.

What the side-by-side finds

Put the records in a grid and the drift is visible in a glance. In the fleet above — a real one, names changed — the audit found an SPF ending in +all on one domain, which authorises the entire internet and which filters treat as no SPF at all. A domain with MX records but no DKIM key on any known selector, which had been sending unsigned for six weeks. Two domains still at p=none while the rest enforced, which matters because filters compare siblings. Two with no www record, losing every prospect who typed it. And one on a different nameserver provider, which explained why the last two DNS changes had missed it.

The audit, in ten minutes

Pick the reference domain — the oldest, or the one set up most carefully — and compare every other domain against it on the records that decide delivery: nameservers by provider, MX by host, SPF by sorted mechanisms, DMARC by policy tags, DKIM by which selectors exist, MTA-STS and TLS-RPT by presence, CAA, DNSSEC, and whether www resolves. The DNS diff does exactly that for up to twenty-five domains, with a grid like the one above, a table of every difference with both values, and a CSV of the raw records. Without a reference it uses the majority value per record, which works when the fleet is mostly right and badly when a bad template was copied everywhere — pick a reference.

Fix order

SPF +all and missing DKIM first — those are the two that cost inbox placement today. Then DMARC policy, brought to one value across the fleet. Then the stale includes, which are harmless until the lookup count crosses ten. Then www records, which cost replies rather than placement. Nameserver consolidation last, and only if someone will own it; split providers are not wrong, just easy to forget.

Keeping it from drifting again

A snapshot audit finds today's drift. The fleet starts drifting again tomorrow, the next time someone adds a tool or registers a domain. Two habits hold it: register every new domain from the same template, at the same registrar, on the same nameservers, and put the whole fleet on the domain monitor, which checks the same thirty records daily and emails when one changes. The audit becomes a thing that happens to you instead of a thing you remember to do.

Frequently asked questions

Keep reading