Your record is unchanged, your senders are unchanged, and your pass rate has moved. Six things can do that, and none of them involves anyone touching your zone.
The six
| What changed | How it reaches you | How to notice |
|---|---|---|
| A vendor changed their SPF include | Their record grew and yours now exceeds ten lookups, so SPF permerrors | Lookup-count monitoring alerting at 9, not at failure. |
| A vendor rotated a delegated DKIM key badly | Their key record broke; your aligned DKIM stops verifying | Pass rate per signing domain, not as one estate figure. |
| Someone created a new subdomain and started sending from it | It inherits sp, which may be reject | Unknown sources in reports, reviewed weekly. |
| A receiver updated its Public Suffix List copy | The derived organisational domain changed, so alignment or discovery changed | Rare. Visible as one receiver diverging from the rest. |
| A receiver changed how it handles ARC or forwarding | Previously overridden failures now count, or the reverse | A step change confined to one reporting receiver. |
| A platform started or stopped signing | An aligned pass appears or disappears with no other symptom | Per-source pass rate over time. |
The diagnostic pattern
Drop across ALL receivers, one sending source
-> that source changed. A vendor did something.
Drop at ONE receiver, all sources
-> that receiver changed. Their PSL, their ARC handling,
their policy. Rarely actionable.
Drop across all receivers, all sources
-> you changed something, or your DNS is unwell.
New source appearing, failing
-> a new system, or spoofing. Identify before assuming.Two axes — receiver and sending source — resolve nearly every unexplained movement. A dashboard that reports a single estate-wide pass rate cannot express either, which is why it tells you something is wrong and never what.
The most common answer is a vendor
You are exposed to the SPF records, DKIM keys and signing behaviour of every platform that sends as you, and all of them change theirs without telling you. Before looking for a change on your side, check whether anything on theirs moved — it usually did.