Daily cold email domain health check with automatic fixes

Every morning at 7am, audit the DNS configuration of every cold email domain in my InfraForge account and repair what has drifted.

Start with List Domains to get the full inventory of domains on the account. Before checking anything, skip any domain purchased in the last 48 hours, because its records may still be propagating and will look broken when they are simply not live yet. Keep track of which domains you skipped so you can mention them in the summary.

For each remaining domain, call Get Domain DNS and compare the records that come back against the baseline InfraForge originally provisioned: the SPF record, the DKIM records, the DMARC record, and any forwarding records. Flag anything missing, altered, or pointing at the wrong host. InfraForge provisions these domains to a consistent pattern, so when one domain deviates from the pattern that holds across the rest of the fleet, treat that as drift worth investigating rather than assuming it is intentional.

Two rules govern every write, and getting them wrong will break authentication on a live sending domain. First, Update Domain DNS replaces the entire record set for a domain rather than patching an individual record, and it requires the records in the exact order returned by Get Domain DNS. So always call Get Domain DNS for a domain immediately before writing to it, build the corrected record set directly from that exact response, preserve the original ordering, and carry every record that was already correct through unchanged. Never submit a partial record set, and never write based on a read you did earlier in the run. Second, never touch a domain that fell inside the 48 hour window.

Repair automatically only where the correct value is unambiguous, such as a standard record that has gone missing entirely or is pointing at a host that is clearly wrong. When the same DMARC or forwarding correction applies across many domains at once, use Bulk Update Domain DNS rather than repeating single updates. If the correct value is ambiguous, if the record looks deliberately customized, or if the fix has to happen at the registrar rather than inside InfraForge, do not guess: leave the domain alone and escalate it.

Post one Slack summary with Send a Message that groups the domains into three buckets: repaired, listing what was wrong and what it was changed to; still broken, listing what is wrong and why it could not be auto repaired; and healthy, where a count is enough. Note any domains skipped for being under 48 hours old.

For every domain that could not be auto repaired, open a Linear issue with Create Issue naming the specific record that is wrong, its current value, and the expected value, so someone can fix it at the registrar without redoing the investigation. Create one issue per affected domain rather than a single combined issue.

Keep the scope to DNS record integrity. Do not attempt blacklist checks, inbox placement testing, or sender reputation monitoring, as InfraForge does not expose operations for those and the summary should not imply otherwise.