Authentication changes even when nobody edits the DMARC record.
New SaaS tools appear, vendors rotate infrastructure, applications change return paths and gateways start modifying mail.
Monitor:
- new DMARC source IPs/providers;
- SPF permerrors;
- DKIM failure changes;
- alignment failure rates;
- unknown selectors;
- DNS changes to authentication records.
Tie alerts to the sender inventory so a known planned migration does not look identical to an unauthorized sender.