DNS
DNS monitoring that catches the change you didn't make.
A flipped A record or a swapped nameserver is an incident, whether it was an attacker or a teammate with fat fingers. CertSentry snapshots six record types daily and alerts only when a change shows up twice - so propagation lag never pages you.
Free personal workspace forever · No credit card
The coverage
What this watch covers
Six record types, snapshotted daily
A, AAAA, MX, NS, CNAME and TXT for every watched host, compared against yesterday's snapshot record by record.
Confirmed before it alerts
A change has to appear on two consecutive snapshots before anything is sent. TTL churn and propagation noise stay silent; real changes don't.
You see what changed
The watch keeps the before-and-after snapshots, so triage starts from which records appeared, disappeared or changed - not from digging through dig output.
A security signal, not just an ops one
A nameserver you didn't change is the classic first move of a domain hijack. Pair the DNS watch with Certificate Transparency monitoring and a rogue certificate issued afterwards shows up too.
Questions
Common questions
Will DNS propagation cause false alarms?
No. That is exactly why changes must be confirmed on two consecutive daily snapshots before an alert fires.
Which records are watched?
A, AAAA, MX, NS, CNAME and TXT. That covers where traffic goes, where mail goes, who answers for the zone, and the TXT records that authenticate your senders.
Can I watch subdomains?
Yes - any hostname can be a monitor, so api.example.com and www.example.com can each carry their own DNS watch.
Why do MX and TXT changes matter?
Because mail breaks quietly. A changed MX reroutes delivery; a mangled SPF record starts failing authentication. If you run DMARC monitoring with us, you will see the failure rate move too.
The rest of the watch
Also on watch
- SSL certificatesExpiry ladder alerts, broken-cert detection and a TLS grade per check.
- Domain expiryRegistry-sourced expiry dates with the 30-to-1-day warning ladder.
- UptimeChecks from 7 regions; down only when two regions agree, twice.
- Cron jobs & heartbeatsA ping URL per job; an alert the moment the pings stop.
- Certificate TransparencyDaily CT log sweeps; an alert on any new certificate for your domain.
- DMARC reportsParsed aggregate reports, new-sender alerts and failure-rate warnings.
The next expiry email you get should be from us.
Not from a furious client. Add your first domain in under a minute.
Start the watch - free