Detecting Demons in Disguise?

[DerNils]

I am in book 2 of Path of the Righteous and now the topic on how to detect shapechanged demons has come up quite a few times. Their first run in with on of the deserter demoms (forgot the name) has made them exceedingly wary, and I have to admit that I myself am a bit fuzzy on what should and should not work. Now that in Drezen the Succubus traitor comes up, this will become even more interesting.
So, what are the go to ways to identify demons in disguise? We do have a paladin and a witch, so Detect Magic and Detect Evil are quite easy. I am just wondering if that is not too easy. I mean, if it is just a matter of having a paladin standing at the gate and looking at all the incoming traffic, how did any demon ever get into Kenabres?
I played a little loose with the way the burners are doing things, to get some witch hunting madness going (if it doesn't burn, it's at minimum a Tiefling). That led to my players asking if a shapechanging demon could not simply imitate burn marks.
So, how are your demon hunters handling this?

[DM Shade]

I often assume that magical measures are either difficult to obtain (especially in small settlements or uneducated areas), or are standardized procedure (in strongholds or cities). Once you establish where you are between the two extremes, you quantify the threat, thereby showing the limitations of the city's (in this case, Kenabres's) defenses.

Kenabres has paladins and a mostly-stable government. They could shell out tax money for some procedures.

1. Anti-Evil Wards: Detect evil wards or guard towers (treat as magic items) to be at the gates, and paladins patrol along the wall. That is relatively cheap--around 2,000 gp per tower or ward (level 1 spell, constantly active, pointing in one area).
Weakness As a magic item, it could be suppressed (dispel magic), has its effect redirected (misdirection and similar anti-divination spells), have demons use cultists or unwitting subjects for tasks (detect evil doesn't show unless creature has 5 or more HD, I believe).
2. Follow-up Inspection (related to anti-evil wards): Anti-Evil Wards will probably generate a lot of false positives (people who are angry of being held up could want to punch the dude in front of them), so it's not exactly metal-detector-means-firearm. Once a person is detected evil, they might take them to the side and perform a short test (passing holy water or a ward), which is another mechanic demons could possibly circumvent.
Weakness: Charming/dominating the inspector, passing the test via illusions, etc.
3. Evil thoughts detect in detect evil (I believe that was established before in canon, or Jacobs stated it). That means the intent to murder registers as evil (albeit temporarily), although there is no detail on how strong the aura will be. With reverse logic, it stands to reason that if evil beings think about good things, they can possibly muddy the perception of the spell Detect Evil--lorewise by shutting off their mind or focusing on something of an anathema to them--which is doing good.
Weakness: Requires strong willpower and high Wisdom or Charisma. May be restricted to manipulators, barring footsoldier demons from passing in, but not stopping powerful beings who should have exceptional measures.
Take care to not go overboard with the last case, and have it foreshadowed that especially deceptive demons (succubi, for example) are frequently trained on this. You could have a caster level vs. HD check, if the player is conscious of this, as well.

As for witch-burning. I suppose a few ingenuity is required here. Witches and cultists do not resist fire, but demons and tieflings do.
A solution would simply be a different punishment for tieflings. Witch-pyres are iconic, but another iconic thing is holy water and consecrations.
Fire for the witch, being drowned in holy water (a pool or a river in the middle of town is for demons/tieflings.
A town square with a pool of holy water seems very appropriate (and costly, if it needs to be constantly blessed), but there are examples in campaigns for holy-water generators (besides making another magic item, there is the Desna shrine in Jade Regent, book 1).
It has its own weakness (and a side quest)--imagine how damaging to morale desecrating the pool into unholy water would be.

I've also flagged this for advice forum, though it could also work in the general or WotR forums.

[Unicore]

Undetectable alignment works for non demonic foes. Misdirection will work even for the demonic ones. Vigilant players can overcome these spells, but it will cost them time and resources to be hyper vigilant. As I DM this campaign, I usually let PC counter operations work to catch the first couple of spies, but if they leave those measure alone for too long with out changing them up, I expect their opposition to figure it out eventually.