Our DNS supplier charges by the hour and usually works on a three-day turnaround. That is manageable for a website change, but not when a sender has failed authentication and we are trying to protect client mail. We delegated only the email authentication records to Palisade with CNAMEs and left the registrar, nameservers, website records, and everything else where they already were. For SPF, we use the hosted include instead of maintaining a long public record ourselves. Now the Agent can draft a change, I review the before and after diff, and an approved record is served without a new ticket to the supplier. I like that it is reversible: if we ever remove the CNAME delegation, we are back to managing the records at the provider. The big operational win is that the people who host our site are no longer the bottleneck for every email security fix, while the client still keeps control of the rest of their DNS.

We send as our clients' domains, so their deliverability is our problem whether or not it is our fault. Before a big send I open the view and check nothing has moved into the failed column. Twice this year it caught a client's IT team adding a tool without telling anyone, and we knew before the campaign went out.

Our abandoned cart sequence was half arriving, which looks like weak copy rather than a fault. Seeing failed volume climb on the chart is what made it obvious. I rewrote that sequence twice before finding out, and every A/B result from that period is worthless. I would still like a before and-after view around a fix.