Validate the record you depend on
Monitor common address, mail, nameserver, alias, text, and authority record types.
DNS monitoring
See the DNS answer customers receive, not the one you expected.
Validate important records, compare public resolvers, detect propagation disagreement, and optionally require a DNSSEC-validated answer before a bad change becomes a widespread outage.
The public scan proposes coverage first. You review every check before anything is created.
The monitoring gap
DNS failures are often partial before they are global.
One resolver may hold a stale answer while another has the new record. A zone can resolve while returning the wrong target, or DNSSEC can fail even though an unsigned query appears healthy. A useful DNS check compares the answer, not just query success.
A monitoring workflow built for this signal.
Compare public resolver answers
Surface disagreement between configured resolvers so propagation lag and split answers are visible.
Check expected values and DNSSEC
Require a known target and optionally treat the absence of a validated DNSSEC answer as degraded.
Three steps from intent to a usable alert.
- 1
Scan the domain and keep the recommended DNS check.
- 2
Choose the record type, expected value, resolver set, and DNSSEC option.
- 3
Route a down result or resolver disagreement with the returned records attached to the monitor result.
What the check can actually answer.
| Signal | Validation | Operational question |
|---|---|---|
| Existence | Record query result | Did the requested record type return an answer? |
| Correctness | Expected-value match | Does the answer contain the intended target? |
| Propagation | Resolver answer comparison | Do public resolvers agree? |
| Integrity | DNSSEC AD validation | Did a validating resolver authenticate the answer? |
DNS monitoring FAQ
Which DNS records can ServiceAlert monitor?
DNS monitors support A, AAAA, MX, NS, CNAME, TXT, and SOA records.
Can ServiceAlert detect DNS propagation differences?
Yes. Multi-resolver mode compares answer sets and marks the result degraded when configured resolvers disagree.
Does DNS monitoring validate DNSSEC?
It can. When DNSSEC validation is enabled, ServiceAlert requires an authenticated-data response from a validating resolver and surfaces failure as degraded.
Recommended start
Monitor the records that route real traffic.
Begin with a domain scan, then keep only the DNS checks and resolver rules your operating model needs.