A client changed one DNS record and their email started bouncing. You found out from the client.

SPF, DKIM, DMARC, and MX records get edited during a migration, a new vendor, or a well-meaning cleanup, and mail breaks with no warning.

The pain

An agency runs email for thirty clients. One client's IT contractor adds a new sending vendor and rewrites the SPF record, dropping an include the agency set. Mail from the marketing platform starts landing in spam. Nobody notices until the client asks why their campaign got no opens, and by then it has been three days.

MailDrift keeps a snapshot of every watched domain's SPF, DMARC, MX, and named DKIM selectors. On each check it compares the live records against the snapshot and pings your phone when one changes, disappears, or turns invalid, with the record named and the reason spelled out.

MailDrift snapshots each domain's email DNS over free DNS-over-HTTPS and pushes a phone alert the moment a record drifts or goes invalid. Self-hosted on your Cloudflare account, installable on your iPhone.

What's included

SPF, DMARC, MX drift

One snapshot per record per domain. A change, a disappearance, or a validity regression each becomes a named phone alert, edge-triggered so a stable record never nags.

Real iPhone push

Encrypted Web Push from the installed home-screen app. A test-ping button proves the pipe.

DKIM selectors you nameDKIM keys live at a selector you supply per domain. MailDrift watches each one and calls out a revoked key (an empty p= tag) specifically.
Validity checks, not just diffsIt flags two SPF records, a missing all mechanism, a DMARC record with no policy, and a domain with no MX at all.
No credentials, everIt reads public DNS over DNS-over-HTTPS from Google's resolver. No registrar login, no API key, no account that can be rate-limited or banned.
Private by defaultEvery API route sits behind your admin token, compared the timing-safe way. Strangers get a lock screen.

Why pay $49 when DMARC tools have free tiers?

The hosted DMARC platforms bill per domain per month, and they are built around ingesting DMARC aggregate reports, a different job from watching your records for drift. DMARCeye charges $4 per domain each month; dmarcian starts at $19.99 a month and caps domains by plan. An agency watching thirty client domains pays over $120 every month, forever, for report parsing it may not even want.

 Hosted DMARC platformsMailDrift
Price$4/domain/mo and up$49 once, unlimited domains
Main jobParse DMARC aggregate reportsAlert when a record drifts or breaks
Records watchedMostly DMARCSPF, DKIM, DMARC, and MX
Where data livesTheir serversYour Cloudflare account
Report analyticsYes, detailedNo; this is a drift alarm, not a dashboard

If you need DMARC report analytics with per-source pass and fail breakdowns, buy dmarcian or DMARCeye; they do that well. MailDrift is for the agency that wants a phone ping the moment a client's email DNS changes, paid once, watching every domain, with nothing leaving their account.

Up and running in about 10 minutes

1Create the database and apply the included schema.
2Run the included key generator, set your admin token.
3Deploy. Open it on your phone, add a domain and its DKIM selectors, tap Enable alerts.

The README walks every step, including the Windows trap that corrupts secrets when you pipe them the wrong way.

Questions before you buy

How does it read DNS without an API key?

It queries DNS-over-HTTPS, the free public JSON resolver from Google (and Cloudflare's is a drop-in swap). There is no account, no key, and no per-lookup cost, so there is nothing to rate-limit or ban. The default six-hour check on dozens of domains is a trivial amount of traffic.

Do I need to configure DKIM selectors?

Only if you want DKIM watched. A DKIM key lives at a selector name that DNS does not advertise, so you tell MailDrift the selectors your mail provider uses (Google Workspace uses google, for example). SPF, DMARC, and MX are watched with no configuration.

Does iPhone push work?

Yes, from the installed home-screen app on iOS 16.4 or later. Apple requires the home-screen install for Web Push. The kit ships a test-ping button so you can prove it before you trust it.

What does it cost to run?

Cloudflare's Workers Paid plan, $5 a month, paid by you to Cloudflare. The six-hour polling sits far inside that plan's limits. There is no subscription to me and no phone-home in the code.

What is it NOT?

It is not a DMARC report analyzer; it watches your records for drift, it does not ingest aggregate reports or show per-source pass rates. It does not fix records or manage DNS; it tells you when one changed. Alerts go to your phone by Web Push, not to Slack or email. A change and its revert inside one check window collapse into the latest state.

Get it

Full source

Unlimited domains

Free updates to the kit

$49 one-time

Launching soon. Leave your email and the launch link lands in your inbox the moment it is live. One email, no list, no spam.