Integrations

What an integration does

An integration reads the domains and DNS zones in your account at a provider, adds them under Domains, and creates the monitors you choose for each one. It runs when you add it, again every 24 hours, and whenever you choose Run Now.

Integrations are on Enterprise plans. On other plans the providers are shown locked. For alerts in Slack, add a Slack contact - see Alerts and contacts.

Adding one

Under Integrations, choose Add Integration. The form has three steps:

1. Provider - AWS, Azure or Namecheap. It can't be changed once the integration is saved.
2. Credentials - what Mon signs in with, below, and a Name to tell your integrations apart.
3. Monitors - which monitors to create for what it finds, and an optional Fixed Region.

What's imported

Provider	Domains	DNS zones
Namecheap	Every domain registered in the account	The same domains
AWS	Domains registered through Route 53	Public hosted zones in Route 53 - private ones are skipped
Azure	App Service domains in the subscription	DNS zones in the subscription

Each switch under Monitors creates one monitor per domain or zone:

Switch	Creates	Made from
WHOIS Monitors	A WHOIS monitor, alerting 30 days before expiry	Domains
HTTP Monitors	An HTTP monitor on https:// and the domain, every minute	Domains
SSL Monitors	An SSL monitor on port 443	Domains
DNS Zone Monitors	A DNS Zone monitor, below	DNS zones

Only WHOIS Monitors is on to begin with, since an integration can find a great many domains. At least one switch has to be on, or the run fails. A domain that already has a monitor of that kind keeps it - Mon links it to the integration rather than adding a second. Every monitor created counts against your plan's monitors, and is given the default alerts of each contact that has one for its type (see Alerts and contacts).

The Domains column counts what an integration found, and links to them under Domains.

Zones only reach WHOIS, HTTP and SSL monitors when they're also registered domains at that provider. A domain registered elsewhere, whose DNS is hosted in Route 53 or Azure DNS, gets a DNS Zone monitor but no WHOIS monitor - add that one yourself.

New and removed domains

Each daily run adds the domains found since the last one, and creates their monitors. To pick up a domain you've just bought without waiting, choose Run Now on the integration. Turning on another switch later works the same way: the next run creates those monitors for every domain.

A domain removed at the provider isn't removed from Mon. Delete its monitors yourself.

The Status column says how the last run went - Pending until the first run, then Success or Failed - and Error says why a run failed. Last Run is when it finished.

DNS Zone monitors

A DNS Zone monitor reads every record in a domain's zone from the provider, once a day, and keeps them under DNS Records. Its page shows how many records the zone holds, by type, and which integration it's read through.

It doesn't alert when a record changes. To be told about that, put a DNS Record monitor on the records that matter: under DNS Records, choose Create in a record's Monitor Status column. The monitor expects the value the provider holds, alerts your default contact on the first failure, and can be edited like any other.

DNS Zone monitors are on Enterprise plans, and need a domain whose zone was imported through an integration. You can also add one under Monitors with Add Monitor, then DNS Zone, for such a domain.

To keep a copy of the records, choose Export from the menu at the far right of the DNS Records grid. The CSV file holds every record the grid's filters match, in the grid's order, up to 10,000.

Changing records

For a domain whose zone came from an integration, adding, editing or deleting a record under DNS Records makes the change at the provider too - deleting one there removes it from your DNS. A record's name and type can't be changed; delete it and add another. Route 53 alias records, and records with a routing policy, can only be changed at Route 53. On Azure, only A records can be changed from Mon.

Credentials

Every secret is stored encrypted and never shown again once saved. When you edit an integration, leave a secret blank to keep the saved one.

AWS - under Authentication, choose one:

• IAM Role - a role in your own account that Mon assumes, so nothing long-lived is stored. Mon generates an External ID: put it in the role's trust policy as the sts:ExternalId condition before creating the role, then enter the Role ARN. The External ID can't be changed once the integration is saved.
• Access Key - an IAM user's Access Key ID and Secret Access Key.

Either way, the role or user needs to list Route 53 domain registrations and hosted zones and read their records. To change records from Mon, it also needs to change record sets.

Azure - an app registration: its Tenant ID, Client ID and Client Secret, and the Subscription ID holding your domains and zones. Mon finds zones across the whole subscription, but reads each zone's records from the Resource Group you enter, so DNS Zone monitors need it, and can read only the zones kept in that group.

Namecheap - the API User, the Namecheap username the API is enabled for, and its API Key. Namecheap only answers addresses on your API allow list, so choose a Fixed Region - the integration then always calls from that location - and allow its addresses, listed on Locations and IP addresses. DNS Zone monitors read the zone from their own locations, so allow those too, or set their locations to the same one.