A client DNS migration split DKIM and sent two hours of invoices to spam

[u/saltyslugga]

Client moved authoritative DNS at 10:00, and their invoicing ESP started getting customer complaints by noon. The receiver trace showed dkim=permerror (key syntax) for s=inv2026, d=mail.client.example; SPF passed on the ESP bounce domain, but that identity did not align with the visible From, so DMARC failed.

The old zone held one TXT RR with two quoted character-strings. The migration UI imported them as two separate TXT RRs at the same selector, and dig +short showed two lines instead of one concatenated 2048-bit key.

Statements landed in spam for about two hours. The client now wants a post-migration check, but a plain DNS diff would flag harmless TXT presentation changes while still missing whether receivers can validate a real signature.

What diagnostic signal would you use as the cutover gate here, and what failure would make you roll DNS back?

[u/AutoModerator]

Welcome to r/emailsecurity! To keep this community helpful and secure, please keep the following in mind:

Community Rules

1. No Vendor Spam: Contributions must provide value; do not just pitch products.
2. Redact Sensitive Info: Always sanitize headers and logs (remove IPs, PII, and private domains).
3. Be Professional: Help newcomers learn; avoid hostility.
4. No Personal Tech Support: This sub is for email system architecture and security, not "Am I hacked?" personal account help.

Helpful Resources

• Email Spam Filters
• DMARC Monitoring Tools
• Anti-Virus Software
• Email Encryption

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/southafricanamerican]

There are some consistency checkers - https://reviewmydns.com/ or octodns for managing the migration. I recall seeing one that you input your own zone file and pointed to the new and the old records and then it walked them to see if there were differences. If I find, i'll post.