Monitoring client domains as an agency or MSP

Why client domains fail quietly

A client's domain is touched by many people who do not talk to each other: the agency, a previous agency, an internal administrator, a marketing contractor who adds a new email tool. Each change is reasonable on its own. The failures appear later and somewhere else: a certificate that no longer renews, an SPF record over the lookup limit, a subdomain pointing at a deleted site.

None of these produce an error anyone sees. The client finds out from their own customers.

What to monitor on every client domain

Five areas cover most incidents.

1. Certificates: the expiry and hostname coverage of the certificate actually served, for the site and important subdomains.
2. DNS: changes to A, MX, NS and TXT records, with the previous value kept so a change can be explained.
3. Email authentication: SPF validity and lookup count, DKIM keys for the selectors in use, and the DMARC policy and report address.
4. DMARC aggregate reports: which systems send mail as the client's domain and whether they pass.
5. Subdomains: records pointing to resources that no longer exist.

From one-time check to recurring service

A one-time audit is a good first conversation: it shows a client the current state of their domain in terms they can act on. Its weakness is that it is out of date the next time anyone changes a record.

The recurring service is the monitoring: continuous checks, alerts to you rather than to the client, and a periodic report. It is straightforward to price per domain, costs little to deliver once set up, and gives you a reason to speak to the client every month that is not an invoice.

Reporting to clients who do not read DNS

Clients do not want record values. A useful client report says what was checked, what is healthy, what needs a decision from them, and what you already fixed. A single health score with a short list of actions is easier to forward internally than a technical export.

Put your own brand on it. The report is evidence of the work, and a branded PDF with the client's domain on the first page is the artefact that gets forwarded to the person who approves the budget.

Keeping client data separate

When several people in the agency and sometimes the client need access, separate each client's domains and limit who sees what. Read-only access for a client contact is usually enough and avoids accidental changes. Keep an audit trail of who added or removed a domain.

Where to start

Scan three client domains and read the results before deciding anything. In most portfolios at least one has a DMARC record at p=none with no report address, or no DMARC record at all. That finding, shown to the client with a clear next step, is usually enough to start the conversation about ongoing monitoring.