DNS Monitoring & Record Change Alerts

DNS monitoring is the scheduled reading of a domain's DNS records from the authoritative nameservers, compared against the last confirmed answer, with an alert on any difference. Domainyze queries your authoritative servers directly rather than a public resolver cache, stores every record set it reads, and notifies you with the old and new value side by side. No zone transfer, no API key, no nameserver change.

A and AAAA, CNAME, MX, NS delegation, SOA serial, TXT, CAA, and the mail-authentication records built on TXT: SPF at the apex, DMARC at _dmarc, and DKIM at every selector we can discover. Each record type is diffed independently, so an MX change is never buried inside ordinary TXT churn from a verification token.

No. DNS monitoring is included with Pro and Business, and a free account is never scheduled for a zone check. What Free does include is registry monitoring on 5 domains, checked every 12 hours, which covers status, expiry, registrar, transfer lock and the nameserver delegation published at the registry. Upgrading adds the authoritative zone reads, per-record diffs, mail-auth weakening detection, and Slack, Discord and signed-webhook delivery.

That is its main security job. Domainyze compares the NS delegation published at the registry against the nameservers your authoritative servers claim, and alerts on any mismatch or change, which is the earliest visible signal of a hijacked registrar account or a stolen zone. Delegation sits on its own lane, checked more often than the full zone, and faster again on Business than on Pro.

No. There is no agent, no zone transfer, and no delegation change. Everything is read from outside using ordinary public DNS queries, which is exactly why we catch misconfigurations your own infrastructure believes are fine.

Worst case is one check cycle on the lane the record sits on, and delegation runs on the faster of the two. Because we query authoritative servers instead of a cached resolver, you are not waiting on TTL expiry to see the truth: you see the change before most of your users' resolvers do.

No. Every detected difference is re-confirmed against a second independent lookup before it becomes a notification, which filters out resolver glitches and partial propagation. Records that legitimately rotate, such as a load-balanced A record or a rotating verification TXT, can be excluded per record or per domain. TTL values and the SOA serial are excluded from the comparison by construction, so they cannot generate an alert on their own.

Yes, and specifically for weakening rather than only for change: an SPF record that gains a +all, a DMARC policy downgraded from reject to none, or a DKIM selector that disappears all raise an alert, because each one silently reopens your domain to spoofing while mail keeps flowing normally. Alongside change alerts, Domainyze grades your published email-authentication posture and names the specific findings behind the grade.

Yes, to a point. It surfaces specific findings against the records you publish: a DMARC policy left on monitor-only, an SPF record that exceeds the ten DNS-lookup limit, a weak or revoked DKIM key, a missing record. What it does not do is parse your DMARC aggregate reports or score the deliverability of your actual mail flow. It reads the records you publish, not the mail you send.

Yes. All of this data is public, so you can watch a client's zone before you take over their account, confirm a migration completed on a partner's domain, or track a competitor's mail and hosting stack.

No. These are ordinary DNS queries against your authoritative nameservers, a handful per check, consuming negligible bandwidth and causing no measurable load.

An uptime monitor tells you a URL stopped answering. DNS monitoring tells you the record that pointed at it changed, usually minutes before the outage and sometimes with no outage at all, as when MX records are repointed and mail is quietly rerouted while the website stays up.