Verification, statuses and re-checks

Issue Mint checks your records against public DNS rather than asking your provider, on a schedule, so nobody has to sit on the page refreshing. Every record is checked independently, and each one is marked with what was found.

Verification is also what moves your newsletter across. The website switches to your domain when the website records pass, and issues start being sent from your own address when the sending records pass, without you pressing anything.

Which resolvers Issue Mint queries

Two public resolvers, 1.1.1.1 and 8.8.8.8, in that order, and the first one to answer decides the result.

That is deliberate rather than incidental. Asking your DNS provider directly would tell us what your provider believes, which is often true minutes before the rest of the world agrees. Public resolvers see what a mailbox provider or a reader’s browser sees. It also means a lookup on your own machine can disagree with the table for a while, usually because your computer or your office router is holding a cached answer.

How often a domain is re-checked

Three cadences, depending on where the domain stands.

A domain added in the last two days that has not verified is checked every ten minutes, on the assumption that somebody is probably watching. After that, an unverified domain is checked hourly, which is enough to notice a record added weeks later. A verified domain is checked once a day, so a record deleted by accident is found within a day rather than the next time somebody publishes.

Verify now runs the whole set immediately, and the domain tab prints the time of the last check beside it.

The three record statuses

Each record in the table is one of three things.

Not found yet means nothing answered at that hostname. Either the record has not been added, or it has not spread yet. Verified means the value found matches what Issue Mint asked for. Wrong value means something answered and it was not what was expected, which is the more useful failure of the two: Issue Mint prints what it found underneath what it wanted, and that line is usually the whole diagnosis. Working through a record that will not verify starts there.

The four domain statuses

The domain’s own status is a summary of the records that count.

Not checked yet is a domain added moments ago. Partly verified means some records have passed and others are outstanding, which is the normal state of a domain mid-propagation. Verified means every record that counts has passed. Not working means either a record is answering with the wrong value, or the domain was verified in the past and has stopped being so, which is the case worth interrupting somebody for.

Which records count towards verified

Not all of them, and the exceptions are on purpose.

The suggested DMARC record never counts, because plenty of domains already have a policy and Issue Mint must not tell somebody their stricter one is wrong. On a domain using www as its canonical host, the two records for the bare domain stop counting as well, since a provider that cannot answer a CNAME at the root is not something you can fix. Both keep appearing in the table and keep being checked either way, so nothing is hidden, and switching back later needs no new records.

What verification is forgiving about

More than you would expect, because providers differ in ways that are not mistakes.

A trailing dot or its absence is fine, upper and lower case are treated the same, and a long TXT record split into quoted chunks is reassembled before comparison. An MX record is matched on its target rather than its priority. An SPF or DMARC record may carry other terms alongside the ones Issue Mint asked for. The two website records and the tracking record may come back as addresses rather than as the CNAME you entered, which is what Cloudflare does at the root of a domain, and that verifies green.

The certificate and DKIM records are the strict ones. Something other than Issue Mint has to follow those, so a flattened or proxied version of them genuinely does not work, and reporting them as fine would be worse than failing them.

The emails and the banner

A domain that has never verified gets two reminders, roughly a day and three days after it was added, each listing the records still outstanding and what was found instead. After the second one, Issue Mint stops writing.

A domain that was verified and has broken gets an email straight away instead, because that is nearly always an accident: a tidy-up at the DNS provider, or a registrar migration that dropped records. The dashboard also carries a banner for any domain that has been unverified for more than an hour, which is late enough that ordinary propagation does not trigger it. Every one of these says the same thing about consequences: your newsletter carries on working at its issuemint.com address, and this affects the custom domain only.