Every control has a decay rate, and the review cadence should be derived from it rather than from a calendar convention. Some things go wrong in hours; some take years and then matter enormously.
Decay rates
| What | Goes wrong in | So check |
|---|---|---|
| DNSSEC signatures | Days — a stopped signer is a cliff at the expiry | Hourly, from a validating resolver |
| MTA-STS policy host certificate | Whenever the renewal process forgets a host serving one file | Daily, on days remaining |
| TLSA digests against the served key | Every renewal that rotates the key — as often as every 60 days | Hourly, by comparison |
| SPF lookup count | Whenever a vendor grows their include, with no change on your side | Weekly |
| DMARC pass rate | Whenever a platform changes its signing or a gateway starts rewriting | Per report, per sending source |
| Dangling records | Whenever a service is decommissioned by somebody who does not own DNS | Quarterly, and at every offboarding |
| Unaccounted-for DKIM selectors | Whenever a vendor relationship ends | Quarterly |
| Registrar lock state and contacts | When somebody clears a lock, or a contact leaves | Monthly |
| Domain expiry | Once, catastrophically | Monthly, plus auto-renew |
| The estate list itself | Continuously, as domains are registered by people outside the team | Quarterly, against registrar accounts |
The pattern
Fast decay = something else changed
vendor includes, vendor keys, certificate renewals,
signer processes. All outside your control, all
silent. These need automated checks.
Slow decay = somebody in your organisation did
something reasonable
cancelled a subscription, offboarded a vendor,
registered a domain, left. These need a checklist
at the moment of the action, and a quarterly sweep
because the checklist will be missed.Neither category is caught by an annual review, which is the cadence most organisations actually run. The fast ones need monitoring; the slow ones need a sweep attached to a process rather than to a date.
Attach the slow checks to events, not to the calendar
“Remove the DKIM selector, the SPF include and any CNAME” belongs on the vendor offboarding checklist, where somebody is already doing something. A quarterly sweep is the backstop for when that checklist is missed — it is not the primary control, and treating it as one means finding things a quarter late.