Start watching
Double opt-in. One confirmation email, then alerts only when something changes and a summary on Mondays. Unsubscribe in one click.
How it works
Sign up
Up to three domains and an address. A confirmation email is sent; nothing is checked until you click it.
Baseline
On confirmation every domain is checked immediately and you get a report of what is there and what is missing.
Daily
Every morning the same checks run again and each answer is compared with yesterday's. A change on anything that decides delivery sends an alert that day.
Weekly
Every Monday, a one-page summary of each domain: status line, open findings, and what changed in the week.
What is checked
Thirty-odd signals per domain, the same ones the standalone tools on this site check one at a time: nameservers and A records; MX and null MX; DNSSEC validation; SPF — the record, how many there are, the all mechanism and the DNS lookup count; DKIM keys on the eight selectors that cover Google, Microsoft and the common sending tools, including revoked keys; DMARC and every tag in it; MTA-STS, its policy file and mode; TLS-RPT; BIMI; CAA; IP blocklists for the web and mail servers and domain blocklists for the name itself; whether the website answers over HTTPS; the newest certificate's expiry; and the registration expiry and registrar from RDAP.
What sends an alert
Only regressions. DMARC moving from reject to none, SPF or DKIM disappearing, MX records vanishing, a blocklist listing appearing, a DNSSEC chain breaking, a certificate inside fourteen days, a domain inside thirty days of expiry, a nameserver change. Improvements — a policy tightened, a listing cleared, a key added — are recorded and show in the Monday summary, but they do not interrupt you. Quiet days send nothing at all.
Why daily
Most deliverability incidents I get called about started with a DNS change nobody noticed: a registrar migration that dropped the DKIM record, a colleague who "cleaned up" a TXT record, a sending tool that rewrote SPF, a DMARC policy that someone set to none to stop a bounce and never set back. By the time inbox placement falls, the change is a week old and nobody remembers making it. A daily check with a diff turns that into an email on the morning it happened, with the before and after in it.
Three domains, free, and then
Three per address covers a small business or a founder's personal brand. It does not cover a cold email fleet, and it is not meant to — fleet monitoring across forty or four hundred domains, with the same daily diff, per-domain history, blocklist delisting and the fixes done rather than reported, is the retainer I sell. If you are here with a fleet, book a call and skip the form.
What is stored
Your address, the domain names, and the daily snapshot and change history for those domains. Nothing else, no tracking, no list sharing. Unsubscribe deletes all of it in one click; removing a domain deletes its history. Alerts come from tools@send.toukirahmed.com — a subdomain that publishes SPF, DKIM and DMARC at enforcement, so it should not need a safelist entry.
Frequently asked questions
Is the domain monitor really free?
Yes, for up to three domains per email address, with no time limit. Fleet monitoring beyond that is a paid retainer.
How often are the checks run?
Once a day at 06:15 UTC. Alerts go out the same morning if a regression is found; the summary goes every Monday.
What counts as a change worth an alert?
Anything that would affect delivery for the worse: authentication records removed or weakened, MX or nameservers changed, a blocklist listing, DNSSEC breaking, certificate or registration expiry approaching, the site going down. Improvements are logged but do not alert.
Can I monitor a subdomain?
Yes. send.acme.co is checked like any other name — SPF, DKIM, DMARC and MX on the subdomain itself.
Will you use my address for anything else?
No. It receives the confirmation, the alerts and the Monday summary, and it is deleted when you unsubscribe.
Last reviewed
What to run next
The checks that most often follow this one.
More in this category
Guides that go deeper
When the tools tell you something is wrong
The diagnostics here are free and always will be. When the fix is bigger than a DNS record, this is the work I do.
Deliverability rescue
Mail landing in spam, replies gone quiet, or a domain suddenly blocked. I find the actual cause rather than guessing, and fix it.
- Authentication and alignment failures
- Blocklist delistings and reputation repair
- Gateway and filter-level blocks
- A written report on what broke and why
Email & sending infrastructure
Sending domains, inboxes, authentication and warmup, built to survive volume instead of burning down in a month.
- Domain and inbox fleets at any scale
- SPF, DKIM, DMARC and tracking domains
- Google Workspace — Silver Partner
- Handover documentation you actually own
Domain, DNS & migration
Changing registrar, mail provider or host without a day of downtime or a week of mail silently failing.
- Registrar and nameserver moves
- Workspace and Microsoft 365 migrations
- MX, SSL and subdomain cutover
- Staged rollout with rollback at every step
Monitoring & retainer
Infrastructure drifts. Records get edited, certificates expire, domains get listed. Ongoing eyes on the fleet.
- Scheduled checks across every domain
- Alerts before your clients notice
- Monthly reporting
- Priority response when something breaks
Start with a call
Bring a domain and the symptom. I will tell you what is actually wrong and whether you need me at all — plenty of people leave that call able to fix it themselves.
Thirty minutes, no pitch
We will run the checks together on your actual domains, and you will leave knowing what is broken, what it takes to fix, and what it should cost. If that is a job you can do in-house, I will say so.