SPF, DKIM, DMARC, and MX records get edited during a migration, a new vendor, or a well-meaning cleanup, and mail breaks with no warning.
An agency runs email for thirty clients. One client's IT contractor adds a new sending vendor and rewrites the SPF record, dropping an include the agency set. Mail from the marketing platform starts landing in spam. Nobody notices until the client asks why their campaign got no opens, and by then it has been three days.
MailDrift keeps a snapshot of every watched domain's SPF, DMARC, MX, and named DKIM selectors. On each check it compares the live records against the snapshot and pings your phone when one changes, disappears, or turns invalid, with the record named and the reason spelled out.
MailDrift snapshots each domain's email DNS over free DNS-over-HTTPS and pushes a phone alert the moment a record drifts or goes invalid. Self-hosted on your Cloudflare account, installable on your iPhone.
One snapshot per record per domain. A change, a disappearance, or a validity regression each becomes a named phone alert, edge-triggered so a stable record never nags.
Encrypted Web Push from the installed home-screen app. A test-ping button proves the pipe.
The hosted DMARC platforms bill per domain per month, and they are built around ingesting DMARC aggregate reports, a different job from watching your records for drift. DMARCeye charges $4 per domain each month; dmarcian starts at $19.99 a month and caps domains by plan. An agency watching thirty client domains pays over $120 every month, forever, for report parsing it may not even want.
| Hosted DMARC platforms | MailDrift | |
|---|---|---|
| Price | $4/domain/mo and up | $49 once, unlimited domains |
| Main job | Parse DMARC aggregate reports | Alert when a record drifts or breaks |
| Records watched | Mostly DMARC | SPF, DKIM, DMARC, and MX |
| Where data lives | Their servers | Your Cloudflare account |
| Report analytics | Yes, detailed | No; this is a drift alarm, not a dashboard |
If you need DMARC report analytics with per-source pass and fail breakdowns, buy dmarcian or DMARCeye; they do that well. MailDrift is for the agency that wants a phone ping the moment a client's email DNS changes, paid once, watching every domain, with nothing leaving their account.
The README walks every step, including the Windows trap that corrupts secrets when you pipe them the wrong way.
It queries DNS-over-HTTPS, the free public JSON resolver from Google (and Cloudflare's is a drop-in swap). There is no account, no key, and no per-lookup cost, so there is nothing to rate-limit or ban. The default six-hour check on dozens of domains is a trivial amount of traffic.
Only if you want DKIM watched. A DKIM key lives at a selector name that DNS does not advertise, so you tell MailDrift the selectors your mail provider uses (Google Workspace uses google, for example). SPF, DMARC, and MX are watched with no configuration.
Yes, from the installed home-screen app on iOS 16.4 or later. Apple requires the home-screen install for Web Push. The kit ships a test-ping button so you can prove it before you trust it.
Cloudflare's Workers Paid plan, $5 a month, paid by you to Cloudflare. The six-hour polling sits far inside that plan's limits. There is no subscription to me and no phone-home in the code.
It is not a DMARC report analyzer; it watches your records for drift, it does not ingest aggregate reports or show per-source pass rates. It does not fix records or manage DNS; it tells you when one changed. Alerts go to your phone by Web Push, not to Slack or email. A change and its revert inside one check window collapse into the latest state.
Full source
Unlimited domains
Free updates to the kit
Launching soon. Leave your email and the launch link lands in your inbox the moment it is live. One email, no list, no spam.