DNS record monitors

What it checks

A DNS Record monitor looks a name up for one record type - the MX records of example.com, say - and compares the answer with the records you said it should have. If the answer is different, the monitor is down.

Each lookup goes through the resolver at the location doing the check, without a cache of Mon's own, so it sees what people near that location see. Response time is how long the lookup takes to answer.

Adding one

Under Monitors, choose Add Monitor, then DNS Record, and enter:

• Host - the name to look up, such as example.com, www.example.com or _dmarc.example.com. It needn't be a machine that answers: a mail or text record names no server to reach.
• Query Type - which records are asked for. A by default.
• Expected Records - one per line, in any order. Leave it blank and Mon looks the name up when you save, and takes whatever answers then as what should answer from then on. If nothing answers, the monitor can't be added that way - enter the records yourself.

The monitor is named after the host and type - example.com - MX - unless you change it. Interval, timeout, maintenance windows and locations work as for any monitor; see How checks work. DNS Record monitors can be checked every minute on paid plans.

To add several at once, choose Add several at once and paste the names into Names, one per line or separated by commas. Each gets its own monitor, with the same query type and the same expected records - leave those blank to take each name's own answer.

Record types

Type	What the answer is compared as
A, AAAA	Each address
CNAME	The name it's an alias of
MX	Preference and server, such as 10 mail.example.com
TXT	Each text string
NS	Each name server
PTR	The name an address points back at
SRV	Each target host
SOA	The primary server, the contact, then serial refresh retry and expire minimum on their own lines
DS, DNSKEY	The digest, or the public key
CAA	Flags, tag and value, such as 0 issue "letsencrypt.org"
TLSA	Usage, selector, matching type and the hash, such as 3 1 1 0d2280aa…
SSHFP	Algorithm, fingerprint type and the fingerprint, such as 4 2 b259fde2…
NAPTR	Order, preference, flags, service, expression and replacement
URI	Priority, weight and the URI in quotes

Each is written as a zone file writes it, so an expected record can be copied from one. The list leaves out DNSSEC's RRSIG and NSEC records, which change every time a zone is re-signed - a monitor expecting a fixed one would keep going down - and types no longer in use.

How the answer is compared

The whole set has to match: every expected record present, and nothing else. A record added alongside the ones you expect makes the monitor go down as surely as one that's removed. Order doesn't matter, spaces at either end and a trailing dot are ignored, and anything else - letter case included - has to match exactly.

A long TXT record, such as a DKIM key, can be published as several strings, and each is compared as a line of its own. The easiest way to get one right is to leave Expected Records blank and let Mon take it as it answers.

Across locations

A check asks one location first. If the answer isn't the one expected - or the lookup fails or times out - Mon asks the next location, up to 8 of them. The monitor goes down only when every location tried got a different answer, and it's up as soon as one gets the right one.

So a monitor doesn't wait for a change to reach every resolver: while a new value is spreading, it stays up as long as some location still sees what it expects. To see what each location's resolver answers right now, with its TTL, use the lookup on Mon's DNS monitoring page.

When a record changes

The monitor goes down and its contacts get a Monitor Down alert. The failed check records what was expected and what was found. Out of the box, DNS monitors alert on the 2nd failure in a row - see Alerts and contacts.

If you made the change on purpose, tell Mon it's right:

• Under DNS Records, open the record's menu and choose Accept DNS Change. It's offered while the record's monitor is down. The value Mon last found becomes what's expected, and the monitor is checked again straight away.
• Or edit the monitor and change its Expected Records.

DNS Records

Every DNS Record monitor belongs to a domain - Mon adds the domain under Domains if it isn't there yet - and once its first check gets an answer, the record appears under DNS Records, with its value, TTL and Monitor Status. On Enterprise plans, a DNS zone imported through an integration lists every record in it, and Create in the Monitor Status column puts a monitor on one.

DNS Record and DNS Zone monitors

A DNS Record monitor asks the public DNS, as anyone would. A DNS Zone monitor reads a domain's whole zone from your DNS provider instead, through an integration, once a day - see Integrations. For a domain's registration and expiry, use a WHOIS monitor.