How DNS changes cause outages
Records get edited during unrelated work, zones are recreated from old exports, registrar parking records reappear, and records believed to be unused are deleted.
In each case the server, the application and the certificate are fine, but the site is unreachable or points to the wrong address.
Know which record changed
A website monitor will eventually notice the outage, but it looks like a failed server. It cannot tell you that a record now points somewhere else.
The DNS monitor reports the value it found and the value it expected, so you fix the record instead of investigating a healthy server.
Monitoring mail records
A missing MX record causes no visible outage: mail bounces or is delivered elsewhere. SPF, DKIM and DMARC records fail the same way. Remove one and mail keeps flowing while failing authentication, until major providers start rejecting it.
You can monitor both MX and TXT records.
Flexible matching
DNS answers rarely match exactly what you typed. MX answers include a priority, TXT records can come back in several parts, and CNAME and NS answers end with a trailing dot.
To avoid false alarms, the expected value is matched as a case-insensitive substring, and trailing dots are ignored.
Which records to monitor
Start with the records outages come from. The apex A record, www and your MX records cover most problems.
Match a distinctive part of the value. For an SPF record, match your mail provider’s include rather than the full record, which changes whenever you add a sender.
Check hourly. DNS changes are made by people, so checking every minute adds little.
Monitor every DNS provider you use. The check is a standard lookup, so it works wherever a domain is hosted.
Frequently asked questions
- Which record types are supported?
- A, AAAA, CNAME, MX, TXT and NS. SOA is not supported because its serial changes with every zone edit.
- Does the value have to match exactly?
- No. It is matched as a case-insensitive substring, and trailing dots are ignored, so MX priorities and multi-part TXT records do not cause false alarms.
- Does the domain need to be connected to the platform?
- No. The check is a standard DNS lookup, so it works for any domain at any DNS provider.
- What happens if the record no longer exists?
- The check fails and reports that no record of that type exists, which is a different message from a record with the wrong value.
- Does it query every nameserver?
- No. It resolves the record the way a client would. Comparing individual nameservers needs a different tool.
Key points
- A, AAAA, CNAME, MX, TXT and NS records
- Reports which record changed
- Substring matching avoids false alarms
- Works with any DNS provider
- Missing and wrong records reported separately