DNS monitors

A DNS monitor looks up one record type for one domain from each of your check locations and alerts you when the answer is wrong. Use it to catch hijacked or accidentally edited records, a CNAME that stopped pointing at your CDN, missing MX records, or a broken SPF or DMARC TXT record.

DNS monitors depend on your plan. If DNS records is greyed out with (upgrade to use) in the type list, your plan doesn't include it. See Plans & limits.

Create a DNS monitor#

1. Go to Monitors → New monitor.
2. Set What do you want to check? to DNS records.
3. Enter the Domain, for example example.com, www.example.com or _dmarc.example.com.
4. Choose the Record type.
5. Under Alert when, choose The records change or They don't match what I expect.
6. Optionally click Show advanced options to set a resolver, timeout or auto-accept.
7. Click Test to see the current answer, then Create monitor.

Fields#

Domain rules. Enter a name, not an IP address. A URL is accepted and reduced to its host, and a trailing dot is ignored. Labels may contain underscores, so _dmarc and _domainkey names work. Internal-only names are rejected, including anything ending in localhost, local, localdomain, internal, intranet, lan, home, corp, private, arpa, test, invalid or onion.

Record types and value formats#

Before comparing, SutramX normalises both your values and the answer:

• Host names are lower-cased and the trailing dot is removed.
• IPv6 addresses are compared in their compressed form, so 2001:0db8::0001 equals 2001:db8::1.
• TXT records split into several strings are joined into one value.
• An MX value without a priority matches that mail server at any priority.
• Order, duplicates and TTLs never matter; records are compared as a set.

Matching modes#

The records change#

The first answer each location sees becomes that location's baseline. Every later check compares the answer with the baseline. Any added or removed value fails the check, with a message like:

A records for example.com changed: added 203.0.113.7; removed 93.184.216.34

The monitor stays down until you accept the new records, either manually or automatically:

• Manually. On the monitor's detail page, open the DNS records card and click Accept current records. The records each location sees now become the new baseline, and the monitor recovers once every location matches.
• Automatically. Turn on Accept a change automatically after it has lasted and set the minutes. The change still fails checks and alerts as usual; once it has lasted that long, the new records become the baseline and the monitor recovers.

Changing the monitor's domain or record type starts a fresh baseline.

They don't match what I expect#

You list the values the records must have.

• Exact (default): the answer must contain every expected value and nothing else.
• Allow other values too: the answer must contain every expected value; extra records are fine.

A failure lists what's missing and what's unexpected:

MX records for example.com do not match: missing 10 mx1.example.com; unexpected 10 mx.attacker.example

If the name exists but has no records of that type, the message is No MX records found for example.com; expected ….

When a lookup fails#

A lookup that gets no usable answer fails the check with the error class DNS resolution failed and a message that explains why:

A name that exists but has no records of the chosen type is not a lookup failure. It's an empty answer, compared like any other.

The DNS records card#

The detail page of a DNS monitor has a DNS records card that shows, per location:

• The current answer, and whether it matches the accepted or expected records
• What was added (+) or removed (−) compared with the baseline
• Baseline is set by the next check when no baseline exists yet
• When the answer was last checked

Below that, Change history lists past changes (SutramX keeps up to the 200 most recent changes per monitor). Click Show all … changes to see more.

The monitor's response time is how long the lookup took.

Example: through the API#

{
  "name": "SPF record",
  "type": "dns",
  "interval_seconds": 900,
  "config": {
    "hostname": "example.com",
    "record_type": "TXT",
    "dns_mode": "expected",
    "dns_match": "contains",
    "expected_values": ["v=spf1 include:_spf.example.com ~all"],
    "nameserver": "1.1.1.1",
    "timeout": 5
  }
}

Common questions#

Different locations see different answers. That's normal with geo-DNS or during propagation. In change mode, each location keeps its own baseline, so only a change from what that location saw before fails. Set Resolver to your authoritative name server's IP to get the same answer everywhere.

I changed my records on purpose and now the monitor is down. Click Accept current records on the DNS records card, or turn on auto-accept.

Can I monitor a private zone? No. Only public names can be looked up, and a custom resolver must be a public IP address.