DNS Monitoring

DNS Monitoring tracks your DNS records across multiple regions, detects propagation delays, monitors TTL changes, and validates DNSSEC configuration.

Plan requirement: OPS and above.

FEATURES

Feature	Description
Propagation monitoring	Verify DNS changes propagate to all regions
TTL tracking	Monitor TTL values and detect unexpected changes
DNSSEC validation	Verify DNSSEC signatures and chain of trust
Record type support	A, AAAA, CNAME, MX, TXT, NS, SOA, SRV, CAA
Multi-region	Query DNS from all CheckOps regions

CONFIGURATION

{
  "name": "Production DNS",
  "domain": "api.acme.com",
  "record_type": "A",
  "interval": 300,
  "expected_values": ["203.0.113.10", "203.0.113.11"],
  "check_dnssec": true,
  "regions": ["fr-par", "de-fra", "nl-ams", "uk-lon"]
}

PARAMETERS

Field	Description	Default
`domain`	Domain name to query	Required
`record_type`	DNS record type	A
`interval`	Check frequency in seconds	300
`expected_values`	Expected record values	Optional
`check_dnssec`	Validate DNSSEC	false
`nameservers`	Custom nameservers to query	System default
`regions`	Regions to query from	All available

PROPAGATION MONITORING

After a DNS change, CheckOps queries all selected regions and reports propagation status:

Domain: api.acme.com (A)
Expected: 203.0.113.10

Region         Value            TTL    Status
──────────────────────────────────────────────
fr-par         203.0.113.10     300    PROPAGATED
de-fra         203.0.113.10     300    PROPAGATED
nl-ams         198.51.100.5     3600   STALE
uk-lon         203.0.113.10     300    PROPAGATED

Alerts fire when propagation does not complete within a configurable threshold.

TTL TRACKING

CheckOps monitors TTL values over time and alerts on:

Unexpected TTL changes — TTL value differs from baseline
TTL expiration — Useful for tracking cache behavior
Low TTL detection — TTLs below a threshold (e.g., < 60s) may indicate misconfiguration

DNSSEC VERIFICATION

When check_dnssec is enabled, CheckOps validates:

Check	Description
RRSIG validity	Signature is present and not expired
DS record	DS record exists at parent zone
Chain of trust	Full validation from root to record
Algorithm	DNSSEC algorithm is not deprecated
Key rollover	Detects upcoming key rollovers

DNSSEC failures are reported as CRITICAL since they can cause resolution failures for validating resolvers.

SUPPORTED RECORD TYPES

Type	Use Case	Example
`A`	IPv4 address	`203.0.113.10`
`AAAA`	IPv6 address	`2001:db8::1`
`CNAME`	Alias	`cdn.acme.com`
`MX`	Mail server	`10 mail.acme.com`
`TXT`	SPF, DKIM, verification	`v=spf1 include:...`
`NS`	Nameserver delegation	`ns1.acme.com`
`SOA`	Zone authority	Serial, refresh, retry
`SRV`	Service discovery	`_sip._tcp.acme.com`
`CAA`	Certificate authority	`0 issue "letsencrypt.org"`

USE CASES

Migration monitoring — Track DNS propagation during infrastructure migrations
CDN failover — Verify CNAME changes propagate when switching CDN providers
Email deliverability — Monitor MX, SPF (TXT), and DKIM records
Security — Ensure CAA records restrict certificate issuance to authorized CAs
DNSSEC compliance — Continuous validation for regulated environments