Per monitor
Ignore noisy record types
Leave record types that change by design out of the comparison entirely.
- Bitmovin
- HBO Nordic
- Obsidian
- Laravel
- Fathom Analytics
- PHP 8
- Stanford University
- Takeaway.com
- IGN
- VRT NWS
- spatie
A lookup is only a snapshot
See the record change, not just the outage it caused.
dig, nslookup and a browser-based DNS checker answer one question: what does
this hostname resolve to right now? None of them shows which record a client, registrar, host or
previous provider changed while you were elsewhere.
One-off lookup · Scheduled DNS monitoring
Illustrative comparison
A DNS checker run by hand
Answers
What does it resolve to now?
Runs
When someone remembers
Nameservers
Whichever answer comes back
Evidence
Gone when the terminal closes
DNS monitoring with Oh Dear
Answers
What changed since the last check?
Runs
Every two hours by default
Nameservers
Every authoritative one found
Evidence
Timestamped history and a diff
Need the current answer once, without a monitor? Run a one-off DNS lookup.
Change history
Previous and current values
The history holds the value before a change and the value after it, for the most recent checks.
Timestamps and a diff
Each entry is timestamped and summarises what differed, newest first.
History through the API
List the DNS history and retrieve single entries, which is what you need to build your own reports.
Nameserver agreement
Discovery, then comparison
Oh Dear queries every authoritative nameserver it finds, then compares the answers.
Which nameserver differs
When an authoritative answer is out of sync, the result names the nameserver.
Blocking issues
Nameservers out of sync, an unreachable nameserver, no records found, discovery failure.
Record validation
Mail records
An SPF record ending in +all, two SPF records on one name, DMARC on the wrong name.
Structural mistakes
MX or NS pointing at an IP address, a CNAME on the apex, a malformed CAA record.
Advisory by design
Validation findings are shown for review. They do not fail the check or send a notification.
Two different searches
Record monitoring is not DNS server telemetry.
Both are called DNS monitoring, and they are bought by different people for different reasons. Oh Dear does one of them.
What Oh Dear does
DNS record monitoring.
- Authoritative records, and the changes to them
- Nameserver availability and agreement
- Lookup failures and record validity
- DNS history over time
A different job
DNS server monitoring.
- DNS service and process performance
- Query latency, cache behaviour, query volume
- CPU, memory and daemon health
- Infrastructure telemetry
One answer out of three
See exactly where the answers diverged.
A migration updates the record, most nameservers pick it up, one keeps the old answer. Visitors get either, and a manual lookup returns whichever replied first.
Authoritative comparison
Which nameserver is still returning the old value.
Oh Dear queries every authoritative nameserver it discovers for the monitored hostname. When the answers disagree, it names the nameserver, shows the previous and current value, and summarises the difference.
Nameserver
Answer for A example.com
State
ns1.example.com
198.51.100.24
In sync
ns2.example.com
198.51.100.24
In sync
ns3.example.com
192.0.2.10
Differs
Blocking issue
Nameserver out of sync
ns3.example.com still returns 192.0.2.10 while the other authoritative nameservers return 198.51.100.24. This fails the DNS check and notifies your team.
Advisory
SPF record allows every sender
The TXT record on example.com ends in
+all. Findings like this are shown for review only: they do not fail the check and they do not send a notification.
The repair loop stays the same each time: confirm whether the change was planned, check the provider that owns the zone, use the previous state to guide the repair, then watch the next checks until the authoritative nameservers agree again. Oh Dear observes the DNS state from outside; it does not manage your provider and cannot prevent a registrar compromise.
Oh Dear detected an issue that our other uptime monitor did not!
Casey Sprague, CTO at thera-LINK
A record change is not an outage yet. That is the point of watching it.
Noise control
Monitor the records that matter without paging on every change.
Some records are supposed to move. Alerting on every rewrite is how a team learns to ignore the channel.
Per notification
Silence only the change event
Keep the blocking failures on while muting DNS records changed.
Temporary
Snooze during planned work
Mute the check for the length of a migration, then let it come back on its own.
What it checks
- Records discovered on the exact hostname you monitor.
- A hidden CNAME you add by hand in the DNS check settings.
- Every authoritative nameserver Oh Dear can discover for that hostname.
What it does not
- Subdomains of the monitored hostname. Each one is added as its own monitor.
- Resolver latency, cache behaviour and DNS server resources.
- Writing to your zone. Oh Dear reads the published state and never changes it.
- A DNS-provider integration. There is nothing to connect and no credentials to hand over.
When Cloudflare nameservers are detected on a hostname, Oh Dear automatically ignores A and AAAA changes when deciding whether records changed or nameservers agree.
Operational ownership
Send the DNS evidence to the person who owns the fix.
A record change can belong to the domain owner, the mail admin, or one client's account manager. Give each monitored hostname its own responsible people and its DNS alerts arrive on the channels they already use.
One client's zone should not alert the whole team. Route per site, not per account.
Slack
Email
Webhook
No feature tiers
Every check.
Every plan.
DNS monitoring is included with Oh Dear's website-health checks on every plan. Choose by the number of sites you monitor, not by which checks you need.
Start with everything on.
Try DNS monitoring alongside uptime, certificate, domain and the rest of the website-health toolkit.
- DNS monitoring on every plan
- Every monitoring feature included
- Plans scale by monitored site count
- No credit card required
10-day free trial. No credit card.
Before the first check
Questions about DNS monitoring.
What Oh Dear checks, how often, and where DNS monitoring ends.
What is DNS monitoring?
DNS monitoring repeatedly checks the DNS records published for a hostname and reports when they change or stop resolving. Oh Dear queries every authoritative nameserver it discovers, compares the answers, and keeps the history.
How often does Oh Dear check DNS records?
Every two hours by default, for each monitored hostname, and you can slow that down per site. A change made just after a check surfaces at the next scheduled one, so this is a change record rather than an instant alarm.
Can I see a history of my DNS record changes?
Yes. The DNS change history shows the previous and current values with timestamps, the nameservers that answered, and a summary of what differed. Newest results appear first.
What is the difference between DNS record monitoring and DNS server monitoring?
DNS record monitoring asks whether the authoritative records changed, disappeared, disagree, or are malformed. DNS server monitoring asks how a DNS service performs: query latency, cache behaviour, daemon health. Oh Dear does the first.
Does Oh Dear compare every authoritative nameserver?
Yes. Oh Dear discovers the authoritative nameservers for the monitored hostname, queries each one, and reports which is unreachable or out of sync with the others.
Which DNS records does Oh Dear monitor?
Results can include A, AAAA, CNAME, MX, NS, TXT, SOA, CAA and other records discovered on the exact hostname you monitor. Subdomains are added as separate monitors, and a hidden CNAME can be added by hand in the check settings.
Does Oh Dear check for DNS misconfigurations?
Yes. Oh Dear flags common mistakes such as an SPF record ending in +all, two SPF records on one name, a DMARC record on the wrong name, an MX or NS record pointing at an IP address, a CNAME on the apex, or a malformed CAA record. These findings are advisory: they sit next to the record for review and do not fail the check.
Can I ignore DNS records that change frequently?
Yes. Leave selected record types out of the comparison, silence only the DNS records changed notification, or snooze the check while planned work is happening. Some records are supposed to move, and alerting on every rewrite trains a team to ignore the channel.
Does DNS monitoring detect DNS hijacking?
It shows you the warning sign. An unexpected A, NS or MX change is one of the earliest indications of hijacking or a subdomain takeover, but Oh Dear reports the observable change. It cannot prove intent, and it cannot prevent a registrar compromise.
Do I need to connect my DNS provider?
No. Oh Dear reads the authoritative DNS state from outside, the same way a resolver does, so there is no provider integration to set up and no API credentials to hand over. It also means Oh Dear never writes to your zone.
Is there a free way to monitor DNS changes?
You can monitor DNS free during Oh Dear's 10-day trial. Free lookup tools show your records when you remember to look; catching an unplanned change needs a schedule and an alert.
What should a DNS monitoring tool include?
Scheduled checks against every authoritative nameserver, a readable change history, and blocking failures kept apart from advisory warnings. It should route each alert to the owner and sit beside neighbouring checks such as the served certificate and blocklist reputation.
Can agencies or IT teams monitor DNS for client domains?
Yes. Monitor every client domain from one account, organise sites with tags, and route DNS-change alerts per domain so one client's zone does not alert the whole team.
Get started
Start monitoring the DNS your users depend on.
Stop relying on memory and single-moment lookups. Keep DNS changes and nameserver evidence where your team can see them.
