Mailgun Domain Health Check: Weekly DNS and DKIM Monitoring

PromptCreate

Every Monday at 7am, run a health check across all of my Mailgun sending domains so that a broken DNS record never silently kills our email.

Start by calling Mailgun List Domains to enumerate every domain on the account. Follow the pagination links until you have collected the complete list rather than just the first page, so newly added domains are always included without me maintaining a list by hand.

For each domain, call Mailgun Verify Domain to re-check its DNS records, and call Mailgun List DKIM Keys for a Domain to confirm the domain still has an active DKIM key. Read the verification state from the Verify Domain response and the DKIM status from the key list, treating a domain with no active key as a failure. Also capture which specific DNS records came back invalid or missing, since that is what makes the alert actionable.

Append one row per domain per week to a Google Sheets log using Append Values. Each row should capture the run date, the domain name, its verification state, and its DKIM status, so we build an audit trail over time and can see exactly when a domain stopped being healthy.

If any domain comes back unverified or is missing an active DKIM key, post a single alert to our #infra Slack channel using Slack Bot Send a Message. The alert should list exactly which domains failed and which records need fixing, grouped by domain so it is easy to act on. Send one consolidated message per run rather than one message per failing domain.

When every domain passes, do not post anything to Slack. The spreadsheet row is still written on healthy weeks, but the channel stays silent so that an alert always means something real needs attention.

Two implementation notes. Mailgun is region-scoped: EU accounts must call api.eu.mailgun.net instead of api.mailgun.net, and a domain only works against the region it was created in, so make the region straightforward to configure. Also handle errors per domain rather than aborting the whole run, so one domain that errors still lets the rest be checked, logged, and reported.

What does this prompt do?

Every Monday morning, looks up every sending domain on your Mailgun account and re-checks that its DNS records are still valid.
Confirms each domain still has an active signing key, so messages keep passing the checks inboxes use to trust your mail.
Adds one row per domain per week to a Google Sheet, giving you a running audit trail of when each domain was healthy and when it drifted.
Posts a Slack alert naming exactly which domains failed and which records need fixing, and stays completely silent on weeks when everything passes.

What do I need to use this?

A Mailgun account with at least one sending domain set up
A Google account with a spreadsheet where the weekly log should be written
A Slack workspace and a channel for infrastructure alerts, such as #infra

How can I customize it?

Change the timing. Monday at 7am is a good start-of-week checkpoint, but you can run it daily if email is critical to your business, or monthly if your domains rarely change.
Pick the alert channel and how loud it is. Point it at #infra, a private on-call channel, or a direct message, and add an @mention so a real person sees failures.
Choose which domains matter. If your account holds test or retired domains that will never verify, skip them by name so they do not create standing noise.
If your Mailgun account was created in the EU region, point the workflow at Mailgun's EU service address. A domain only works in the region it was created in, so a US-region lookup will not see EU domains.

FAQs

Why does a verified email domain suddenly stop working?

DNS records get changed more often than people expect. A DNS provider migration, a registrar cleanup, someone tidying up records they did not recognize, or an expired entry can all quietly remove the records that authorize Mailgun to send as your domain. Nothing announces the change, so mail simply starts landing in spam or bouncing. A weekly re-check catches the drift within days instead of months.

Will this send me a message every week?

No. The Slack alert only fires when at least one domain fails verification or is missing an active signing key. On healthy weeks the workflow still writes its rows to the spreadsheet but posts nothing, so the channel stays quiet and an alert always means something real.

What does the spreadsheet log give me that the alert does not?

History. The alert tells you something is broken right now, while the log tells you how long it has been broken and when it last worked. That makes it easy to line up a deliverability dip with the exact week a domain fell out of verification, and it doubles as evidence for audits or customer security reviews.

Does this fix the broken records for me?

No, and that is deliberate. It tells you precisely which domains failed and which records need attention, but the actual fix happens in your DNS provider, which the workflow does not touch. Changing DNS automatically is risky, so a human makes that call with the exact details already in hand.

Does this work if I have many sending domains?

Yes. It reads the full list of domains on the account rather than a list you maintain by hand, so newly added domains are covered automatically from the next run. Each domain is checked independently, and one problem domain will not stop the others from being checked and logged.

Related templates

Build a credential rotation checklist when someone leaves

When someone leaves, we check which shared passwords they used in their final months and post a ranked rotation list to your security channel.

+1

Agentic Task

Weekly Amazon S3 bucket security audit posted to Slack

Every Monday, check every S3 bucket for public exposure, missing encryption and weak backup settings, then get the risks ranked in Slack.

Agentic Task

Log Agorapulse social conversations to HubSpot contacts

Twice every weekday, the conversations from your social inbox land on the right HubSpot contact timelines, with a Slack recap for sales.

Agentic Task

Turn procurement portal tenders into CRM deals each morning

Every weekday at 7am, sign in to the tender portals you track, filter new notices against your bid criteria, and open a deal for the ones worth chasing.