Change detection without the noise
Rotating record sets such as CDN pools are recognised and muted. The first records of a new hostname count as discovered, not changed. A failed lookup never reads as a deletion.
Know when your DNS changes, and where your domains are weak.
Monitor DNS refreshes every record of your zones each hour, runs more than 40 security checks across registrar, DNS, web and email, and tells you the moment something changes: on Slack, by email or by webhook.
The free plan monitors one zone and needs no card. Paid plans start with a 7-day trial.
example.com
Has high findings
Findings3 open
- HighDangling DNS recordstaging.example.com points at a released cloud host
- MediumDMARC policy is p=none (monitoring only)_dmarc.example.com
- LowWebsite certificate expires within 14 dayswww.example.com, no renewal seen in CT logs
Changeslast 24 hours
MX
example.com 10 mail.example.com 10 mx1.mailhost.net
Alert delivered to Slack #dns-alerts and 2 email recipients at 14:20 UTC
Nothing to install, no nameserver changes
Monitor DNS only observes. It watches the DNS you already run and the services it points at.
-
Add a zone
Enter a domain. Its records and publicly visible subdomains are discovered and imported. The first full scan starts about 90 seconds later.
-
We refresh and check
Records are refreshed every hour and compared with what was there before. Live checks run alongside, from DNSSEC validation to the certificate on your website.
-
You hear about what matters
Confirmed changes and new findings land in your alert inbox and go out to your channels. Routine churn, such as rotating CDN addresses, stays quiet.
What you get
Change detection that filters noise, a security score you can act on, and alerting you can audit.
A security score with suggested fixes
Every finding carries a severity and a concrete fix. Accept a risk that does not apply to you and it leaves the score until the acceptance expires. Every decision is in the audit trail.
Live checks beyond the zone file
DNSSEC validation, delegation consistency between parent and child, MTA-STS and TLS-RPT, DANE, mail-server blocklists and reverse DNS, website certificates, HSTS and the HTTPS redirect.
Takeovers, certificates and lookalikes
Dangling records are probed every 15 minutes and reported once a problem is seen twice. Certificate Transparency logs are watched for certificates on your names. Newly registered lookalike domains are listed for review.
An alert inbox you can trust
Every alert is stored before it is sent to Slack, email or a webhook, with the delivery result kept on the alert. A failing channel is flagged on the dashboard, a test button checks each channel, and a weekly digest sums up the week.
Built for teams
Organisations with members and invitations, sign-in with GitHub or Google, an audit trail of who changed what, owned versus watched zones for vendors and partners, and CSV or TSV exports of records and changes.
What we check
More than 40 findings, grouped the same way the dashboard groups them. Every plan runs every check.
Registrar & domain
3 findings- Registrar transfer lock missing
- Domain expires within 30 days
- Domain expires within 90 days
DNS & delegation
8 findings- Zone transfer (AXFR) is open
- Subdomain takeover possible
- Dangling DNS record
- Lame delegation
- Nameservers lack redundancy
- Nameservers disagree on the SOA serial
- DNSSEC validation is failing
- Zone is not DNSSEC-signed
Web & certificates
9 findings- Website certificate is invalid
- Certificate expires within 3 or 14 days
- Certificate issued by a CA your CAA does not allow
- No CAA record
- CAA without an issue tag
- No Strict-Transport-Security
- HTTP without a redirect to HTTPS
- Hostname certificate expiring with no renewal seen
Mail transport
8 findings- Mail server address on a DNS blocklist
- MX points at a CNAME, an IP or an unresolvable host
- No MX and no null MX
- No MTA-STS record
- MTA-STS policy not enforced
- No TLS-RPT record
- Mail server without matching reverse DNS
- Signed zone without DANE (TLSA) records
Email authentication
13 findings- No DMARC record
- DMARC policy is p=none
- DMARC policy incomplete
- DMARC reports sent to an unauthorised receiver
- No SPF record
- SPF record invalid
- SPF authorises any sender
- SPF ~all while DMARC is not enforcing
- No DKIM record
- No usable DKIM key
- DKIM key shorter than 2048 bits
- No BIMI although DMARC is enforcing
- BIMI record not usable
Live checks run hourly. A takeover candidate must be seen twice in a row before it becomes a finding. Zones you watch but do not own, such as vendors or partners, are checked the same way but kept out of your score.
Look up a domain now
A quick view of what the public DNS says about a name. Queries go straight from your browser to Cloudflare's DNS-over-HTTPS resolver; nothing is sent to us.
| Name | Type | TTL | Data |
|---|
A one-off lookup shows the present. Monitor DNS keeps the history, notices the differences and runs the checks a lookup cannot.
Pricing
Every plan includes every check, every alert channel and the weekly digest. Plans differ in how many zones and team members you can have and how long history is kept.
Free
€0forever
No card required
- 1 zone
- 1 team member
- 7 days of history
Basic
€5per month
or €50 per year
- 5 zones
- 3 team members
- 3 months of history
Standard
Most popular€15per month
or €150 per year
- 15 zones
- 5 team members
- 1 year of history
Enterprise
Custom
Invoiced yearly
- Zones and members to fit
- Longer history
- Direct line to the team
Prices in EUR; VAT may apply. Billing is handled by Stripe. Change or cancel a plan at any time from the dashboard; the service runs until the end of the paid period.
Questions
Do I need to change my nameservers?
No. Monitor DNS does not host your DNS. It watches the setup you already have and the services it points at.
How often is everything checked?
Records are refreshed hourly and live checks run hourly as well. Takeover candidates are probed every 15 minutes, Certificate Transparency logs are scanned continuously and lookalike domains once a day.
Which record types are monitored?
All common types: A, AAAA, CNAME, MX, TXT, NS, SOA, SRV, PTR, CAA and more. Publicly visible subdomains are discovered when you add a zone, and you can add your own.
How are alerts delivered?
Every alert is kept in the inbox in the dashboard and sent to the channels you configure: Slack, email or a webhook. A channel can cover all zones, including ones you add later, and the delivery result stays on the alert.
I just added a zone and got no alerts. Why?
For the first 24 hours a new zone's alerts are recorded as already read and not delivered, so the initial import does not flood your channels. Findings are visible in the dashboard right away.
What is a watched zone?
A zone you do not own but depend on, such as a vendor or partner. It is monitored like any other zone but left out of your score and posture alerts. Set the role when adding the zone or change it later.
A finding does not apply to me. What now?
Use "Accept risk" on the finding. It leaves the score until the acceptance expires or you reopen it, and the decision is recorded in the audit trail. Each finding also comes with a suggested fix if you prefer to resolve it.
Can I export my data?
Yes. Records export as TSV and the change history as CSV, straight from the dashboard. The audit trail lists every action taken in your organisation.
What does the free plan include?
One zone, one member and 7 days of history, with every security check and every alert channel. Paid plans raise the limits and start with a 7-day trial.
Can I cancel at any time?
Yes, from the billing portal in the dashboard. The service continues until the end of the current billing period. If you drop below the limits of a smaller plan you will need to remove the extra zones.