DNS Monitoring

Overview

DNS monitoring verifies that your domain names resolve correctly to the expected IP addresses or values. This is critical for detecting DNS hijacking, configuration errors, propagation issues, and DNS server failures.

DNS monitors query DNS servers and validate the responses match your expected values. They don’t check if the resolved IP addresses are actually reachable.

Use Cases

Domain Resolution

Ensure domains resolve to correct IP addresses

DNS Hijacking Detection

Alert if DNS records are changed maliciously

Configuration Validation

Verify DNS changes have propagated

Mail Server Monitoring

Check MX records point to correct servers

Creating a DNS Monitor

Basic Configuration

Name: Main Website DNS
Domain: example.com
Type: DNS
Check Interval: 5 minutes
Timeout: 10 seconds

Configure DNS Settings

Record Type: A
Expected Values:
  - 93.184.216.34
DNS Server: 8.8.8.8 (Optional)
Validate All Records: Yes

Select Monitoring Regions

Choose regions to test DNS resolution from different geographic locations.

DNS Record Types

UptimeIO supports monitoring all common DNS record types:

IPv4 Address RecordMaps domain name to IPv4 address.

Domain: example.com
Record Type: A
Expected Values:
  - 93.184.216.34

Use for: Website domains, server hostnames

IPv6 Address RecordMaps domain name to IPv6 address.

Domain: example.com
Record Type: AAAA
Expected Values:
  - 2606:2800:220:1:248:1893:25c8:1946

Use for: IPv6-enabled services

Canonical Name RecordMaps alias to canonical domain name.

Domain: www.example.com
Record Type: CNAME
Expected Values:
  - example.com

Use for: Subdomains, CDN configurations

Mail Exchange RecordSpecifies mail servers for domain.

Domain: example.com
Record Type: MX
Expected Values:
  - 10 mail.example.com
  - 20 mail2.example.com

Use for: Email server configuration

MX records include priority numbers. Format: priority hostname

Text RecordStores arbitrary text data.

Domain: example.com
Record Type: TXT
Expected Values:
  - "v=spf1 include:_spf.google.com ~all"

Use for: SPF, DKIM, domain verification

Name Server RecordSpecifies authoritative name servers.

Domain: example.com
Record Type: NS
Expected Values:
  - ns1.example.com
  - ns2.example.com

Use for: Nameserver configuration validation

Expected Values

Configure which values indicate successful DNS resolution:

Single Value

Record Type: A
Expected Values:
  - 93.184.216.34

Incident created if domain resolves to any other value.

Multiple Values

Record Type: A
Expected Values:
  - 93.184.216.34
  - 93.184.216.35

Validate All Records: No - Success if ANY expected value is returned Validate All Records: Yes - Success only if ALL expected values are returned

Use multiple values for load-balanced services or when DNS returns multiple IPs.

Wildcard Matching

For dynamic values, use partial matching:

Record Type: TXT
Expected Values:
  - "v=spf1*" # Matches any SPF record starting with v=spf1

DNS Server Selection

Choose which DNS server to query:

Default (System DNS)
Public DNS
Authoritative DNS

DNS Server: (empty)

Uses UptimeIO’s default DNS resolvers.Pros: Tests real-world DNS resolution Cons: May be cached

DNS Server: 8.8.8.8 # Google DNS
DNS Server: 1.1.1.1 # Cloudflare DNS
DNS Server: 208.67.222.222 # OpenDNS

Query specific public DNS servers.Pros: Consistent, reliable Cons: May not reflect all users’ experience

DNS Server: ns1.example.com

Query your authoritative nameservers directly.Pros: Bypasses caching, fastest to detect changes Cons: Doesn’t test recursive resolution

Leave DNS server empty for most scenarios. Specify a server only when you need to test specific DNS infrastructure.

Validation Options

Validate All Records

Controls how multiple DNS responses are validated:

Setting	Behavior	Use Case
Yes	ALL expected values must be present	Ensure complete DNS configuration
No	ANY expected value is sufficient	Load-balanced services with multiple IPs

Resolution Timeout

Maximum time to wait for DNS response:

Resolution Timeout: 10000ms (10 seconds)

Fast networks: 5 seconds
Standard: 10 seconds (default)
Slow/distant: 15-30 seconds

Additional Record Types

Monitor multiple DNS record types simultaneously:

Primary Record Type: A
Additional Record Types:
  - AAAA
  - MX
  - TXT
Fail on Additional Record Errors: No

How it works

UptimeIO queries all specified record types in parallel with the primary type.Primary record: Must succeed for check to pass Additional records: Captured for reference, failures logged as warnings

Fail on errors

Fail on Additional Record Errors: Yes

When enabled, failures in additional record types will cause the entire check to fail.Use when: All record types are critical Don’t use when: Additional records are informational only

Use additional record types to monitor your complete DNS configuration in a single check.

DNS Response Data

Each DNS check captures detailed information:

{
  "query_type": "A",
  "resolved_ips": ["93.184.216.34"],
  "authoritative": true,
  "resolution_time_ms": 45,
  "nameserver_used": "8.8.8.8",
  "records": [
    {
      "type": "A",
      "value": "93.184.216.34",
      "ttl": 3600
    }
  ]
}

Key Metrics

Resolved Values

The IP addresses or values returned by DNS query.Compared against your expected values to determine success/failure.

Authoritative

Whether the response came from an authoritative nameserver.

True: Direct from authoritative server
False: From recursive resolver or cache

Resolution Time

Time taken to resolve DNS query in milliseconds.

< 50ms: Excellent (cached or local)
50-200ms: Good
> 200ms: Slow, investigate

TTL (Time To Live)

How long the DNS record can be cached.Lower TTL = More frequent updates, higher DNS load Higher TTL = Less frequent updates, lower DNS load

Example Configurations

Name: Main Website DNS
Domain: example.com
Record Type: A
Expected Values:
  - 93.184.216.34
Validate All Records: Yes
Resolution Timeout: 10000ms

Best Practices

Monitor critical DNS records

Always monitor:

Main domain A/AAAA records
www subdomain
MX records for email
Critical subdomains (api, cdn, etc.)

Use multiple regions

DNS resolution can vary by geographic location. Monitor from multiple regions to ensure global accessibility.

Set appropriate check intervals

Critical domains: 5 minutes
Standard domains: 15 minutes
Rarely changed: 1 hour

DNS changes slowly, so frequent checks aren’t usually necessary.

Monitor from different DNS servers

Create separate monitors using different DNS servers:

One using default (system DNS)
One using Google DNS (8.8.8.8)
One using your authoritative nameserver

This helps identify where DNS issues originate.

DNS Hijacking Detection

DNS hijacking is when attackers change your DNS records to redirect traffic:

Set up monitoring

Domain: example.com
Record Type: A
Expected Values:
  - 93.184.216.34 # Your legitimate IP

Incident on change

If DNS resolves to any other IP address, an incident is created immediately.

Immediate alert

Configure critical notifications (SMS, phone) for DNS monitors to respond quickly to hijacking attempts.

DNS hijacking can redirect your users to malicious sites. Always monitor critical domains and set up immediate alerts.

Troubleshooting

NXDOMAIN (Domain doesn't exist)

Possible causes:

Domain not registered
DNS not configured
Typo in domain name
DNS propagation not complete

Steps to diagnose:

Verify domain is registered
Check nameserver configuration
Test with dig or nslookup
Wait for propagation (up to 48 hours)

Unexpected IP addresses

Possible causes:

DNS configuration changed
DNS hijacking
CDN or load balancer changes
DNS cache poisoning

Steps to diagnose:

Verify expected IPs are correct
Check DNS configuration in registrar
Query authoritative nameservers directly
Review recent DNS changes

Timeout errors

Possible causes:

DNS server not responding
Network issues
Firewall blocking DNS queries
DNS server overloaded

Steps to diagnose:

Increase timeout value
Try different DNS server
Check DNS server status
Verify network connectivity

Inconsistent results across regions

Possible causes:

DNS propagation in progress
GeoDNS configuration
Regional DNS servers have different cache
Anycast DNS routing

Steps to diagnose:

Wait for full propagation (up to 48 hours)
Check if GeoDNS is configured
Verify TTL values
Test from multiple locations manually

DNS Propagation

After changing DNS records, propagation takes time:

TTL Value	Propagation Time
60 seconds	1-5 minutes
300 seconds (5 min)	5-15 minutes
3600 seconds (1 hour)	1-4 hours
86400 seconds (24 hours)	24-48 hours

Before making DNS changes, lower the TTL to 300 seconds (5 minutes) 24-48 hours in advance. This allows faster propagation when you make the actual change.

Advanced: GeoDNS Monitoring

For GeoDNS setups that return different IPs based on location:

Create region-specific monitors

Monitor 1 (US):
  Domain: example.com
  Expected Values: [10.0.1.10]
  Regions: us-east, us-west

Monitor 2 (EU):
  Domain: example.com
  Expected Values: [10.0.2.10]
  Regions: europe

Validate regional routing

Each monitor checks that the correct regional IP is returned from its location.

Next Steps

Heartbeat Monitoring

Monitor cron jobs and scheduled tasks

HTTP Monitoring

Monitor web services

Notifications

Configure DNS change alerts

API Reference

Create DNS monitors via API

Getting Started

Monitor Types

Essentials

Notifications

Status Pages

Integrations

Plans & Billing

Overview

Use Cases

Domain Resolution

DNS Hijacking Detection

Configuration Validation

Mail Server Monitoring

Creating a DNS Monitor

DNS Record Types

Expected Values

Single Value

Multiple Values

Wildcard Matching

DNS Server Selection

Validation Options

Validate All Records

Resolution Timeout

Additional Record Types

DNS Response Data

Key Metrics

Example Configurations

Best Practices

DNS Hijacking Detection

Troubleshooting

DNS Propagation

Advanced: GeoDNS Monitoring

Next Steps

Heartbeat Monitoring

HTTP Monitoring

Notifications

API Reference

Getting Started

Monitor Types

Essentials

Notifications

Status Pages

Integrations

Plans & Billing

​Overview

​Use Cases

Domain Resolution

DNS Hijacking Detection

Configuration Validation

Mail Server Monitoring

​Creating a DNS Monitor

​DNS Record Types

​Expected Values

​Single Value

​Multiple Values

​Wildcard Matching

​DNS Server Selection

​Validation Options

​Validate All Records

​Resolution Timeout

​Additional Record Types

​DNS Response Data

​Key Metrics

​Example Configurations

​Best Practices

​DNS Hijacking Detection

​Troubleshooting

​DNS Propagation

​Advanced: GeoDNS Monitoring

​Next Steps

Heartbeat Monitoring

HTTP Monitoring

Notifications

API Reference

Overview

Use Cases

Creating a DNS Monitor

DNS Record Types

Expected Values

Single Value

Multiple Values

Wildcard Matching

DNS Server Selection

Validation Options

Validate All Records

Resolution Timeout

Additional Record Types

DNS Response Data

Key Metrics

Example Configurations

Best Practices

DNS Hijacking Detection

Troubleshooting

DNS Propagation

Advanced: GeoDNS Monitoring

Next Steps