DNS monitoring
Upcheck resolves every domain you own, fingerprints the answer, and tells your team when a name stops resolving — or starts resolving to somewhere it didn't yesterday. By email, Slack, Discord, Teams, or webhook.
$10/month base · $1 per website · resolved every 6 hours
DNS fails in two ways, and only one of them looks like a failure
The loud way is the name that stops resolving — a deleted zone, a botched migration, a delegation that expired with the old provider. The site is down, the error is everywhere, and somebody is already fixing it.
The quiet way is the name that resolves perfectly — to the wrong place. A registrar account gets compromised and the nameservers move. A record left pointing at a cloud IP that was released last quarter gets picked up by whoever holds that IP now. A migration updates half the records and nobody rechecks the other half. In every one of these the site "works", the checks that only ask "does it resolve" stay green, and the traffic — or the email — is going to a machine you do not control.
The record types resolved on every lookup, and what each one going wrong costs.
Nobody watches DNS by hand for the same reason nobody watches a locked door: it never changes. Which is exactly why a change is worth an alert. Upcheck fingerprints the entire record set on every lookup and compares it against the previous one — so the news is not "your DNS is configured", which you knew, but "your DNS is different", which you may not have.
Monitoring DNS in three steps
- 01
Add the websites you own
Upcheck resolves each name through DNS-over-HTTPS, the same path a modern browser takes, reading four record types per lookup: A, AAAA, NS, and MX. No zone access, no nameserver changes, nothing to install.
- 02
Every name is resolved every 6 hours
DNS records change on the scale of days or months, so four looks a day catches a bad change within hours of it landing without hammering resolvers to re-learn the same answer. You can also refresh any website on demand from the dashboard.
- 03
Changes and failures alert your team
Every lookup is fingerprinted and compared against the last one. A record set that moved fires your DNS rules with the addresses it now resolves to; a name that stops resolving entirely is confirmed on a second lookup and reported as failing.
"It resolves" is one bit of a much longer answer
A check that only asks whether the name resolves compresses the whole record set into a yes. Upcheck keeps the set itself — every address, nameserver, and mail exchanger from every lookup — because when something moves, the question is never just "did it change" but "from what, to what, and when".
The answers are normalised and sorted before they are fingerprinted, so round-robin DNS rotating the order of its records never reads as a change — only the set itself moving does. When it moves, the dashboard shows the addresses the name now resolves to, and the alert carries them too.
Every state a DNS check can be in
A changed record set is deliberately not a failure state — it is information, and whether it is good news is something only your team knows. The states keep those two ideas apart.
- OK
The name resolves to at least one address, and the record set matches the previous lookup — or a change was alerted and this set is now the baseline.
- Records Changed
Not a failure — a fact. The fingerprint differs from the previous lookup, your DNS rules fire with the addresses the name now resolves to, and the new set becomes the baseline.
- Failing
No A or AAAA record came back: the name does not resolve, and the site is down for every visitor however healthy the origin is. Confirmed on a second lookup before rules fire.
- Unknown
The resolver itself could not be queried. Kept separate from Failing on purpose — a resolver outage is not your zone dying, and paging you for one would be a false alarm.
- Checking
Just added. The first lookup runs the moment a website lands in the workspace, and its record set becomes the baseline every later lookup is compared against.
Rules that fire on the change, not on the schedule
A DNS rule watches for two events: the record set changing, and a failing name recovering. There is no threshold to tune, because a change has no countdown — it either happened or it did not. When it happens, the alert says so in plain terms and lists the addresses the name now resolves to, so the person reading it in Slack can tell "that is our new load balancer" from "that is not our IP" without opening a terminal.
Rules cover the whole workspace by default, or you can scope one to specific websites — the zone your payments run on can page the on-call phone while a side-project posts to a channel. Each change alerts once, then the new record set becomes the baseline; there is no daily re-announcement of a change everyone has already seen.
Delivery goes to email, Slack, Discord, Microsoft Teams, or your own webhook, where the alert arrives as a structured dns.alert event your tooling can route apart from an outage or an expiring certificate. Email recipients live in named lists you define once and point any rule at.
What to look for in DNS monitoring software
Most DNS monitoring is a resolution check bolted onto an uptime product — it answers "does it resolve" and nothing else. If the failure you are actually guarding against is the record that moved, these are the capabilities that decide whether a tool catches it.
- 01
Change detection, not just resolution
"Does it resolve" catches the loud failure. The expensive one is the name that resolves fine — to an address nobody on your team chose.
- 02
The whole record set
A tool that only watches A records misses the NS change that hands the zone to someone else and the MX change that reroutes the mail.
- 03
Failure confirmed before paging
Resolvers have bad moments too. A no-answer should be confirmed by a second lookup — and a resolver outage should never be reported as your zone dying.
- 04
The visitor's path, stated honestly
A resolver's view shows what the internet actually sees, caches included. A tool should say which view it has — authoritative audit and resolution check are different products.
- 05
Alerts where the team already is
A DNS change is only useful news while it is fresh. Look for Slack, Discord, Teams, and a plain webhook so the alert can open an incident in your own tooling.
- 06
DNS beside the other three checks
The record set, the certificate, the registration, and the site answering are four failures with four clocks. One tool watching all four is how the 3am question gets answered fast.
Four checks, one price
$10 per month for the workspace, plus $1 per website per month — and the dollar covers everything Upcheck watches on that website: DNS every 6 hours, uptime every 5 minutes, the SSL certificate every 12 hours, and the domain registration daily. The per-website charge is metered daily, so adding a website mid-cycle costs only the days it was tracked. Every feature on this page is included at every size; there is no tier that withholds Slack, or webhooks, or history. A workspace can track up to 500 websites.
The other checks on the same websites have their own pages — see website uptime monitoring and domain expiration monitoring.
Frequently asked questions
What is DNS monitoring?
DNS monitoring is the practice of automatically resolving your domain names at a fixed interval and alerting a responsible team when the answer is wrong — either because the name stopped resolving entirely, which takes the site down for every visitor, or because the records changed to values nobody intended, which quietly sends traffic or email somewhere else. A monitor keeps the previous answer, compares each new one against it, and treats an unexplained difference as news.
Which DNS records does Upcheck monitor?
Four record types per lookup: A and AAAA, the IPv4 and IPv6 addresses the name points at; NS, the nameservers answering for the zone; and MX, where the domain's email is delivered. Together they cover the three failures that matter — the site down, the site pointed elsewhere, and the mail rerouted. The full record set from every lookup is kept, so you can see exactly what changed and when.
How does DNS change detection work?
Every lookup resolves all four record types, normalises the answers — lowercased, trailing dots stripped — sorts them, and hashes the whole set into a single fingerprint. Change detection is then one comparison against the previous successful lookup. Sorting first means round-robin DNS that rotates the order of its answers never trips a false change; only the set itself changing does. When it differs, the alert lists the addresses the name now resolves to, and the new set becomes the baseline.
How often does Upcheck check DNS?
Every domain is resolved every 6 hours. DNS records change on the scale of days or months, so four looks a day catches a bad change within hours of it landing without querying resolvers to re-learn the same answer hundreds of times. You can also refresh any website on demand from the dashboard, which runs all four of its checks immediately.
Can Upcheck detect DNS hijacking?
It detects the symptom every successful DNS hijack has to produce: the public record set changing. Whether the cause was a compromised registrar account, an unauthorised nameserver change, or an internal mistake, the moment the resolved answer differs from the previous lookup, your DNS rules fire with the new addresses in the message. What it is not is a security audit — it cannot see an attempt that failed, and it sees a successful change within the six-hour lookup interval plus however long the old answer stays cached at the resolver, not the instant the zone was edited.
Does Upcheck query my nameservers directly?
No. Lookups go through DNS-over-HTTPS to a public resolver — the same path a visitor's browser takes. That is deliberate: it reports what the internet actually sees, including whether a change has propagated, rather than what the authoritative servers claim. The trade-off is that it is not an authoritative zone audit, and a change appears once resolver caches turn over rather than the moment the zone file is saved.
What happens when my domain stops resolving?
A lookup that returns no A or AAAA record marks the check failing — the site is down for every visitor, however healthy the origin — and a second failing lookup confirms it before your rules fire. The 5-minute uptime check is what pages you fast when a dead name takes the site down; the DNS check is what tells you why, and what catches the changes that don't take the site down at all. A recovery alert goes out when a confirmed-failing name resolves again.
Can I monitor DNS for free?
You can run dig by hand for free, and it will faithfully report the answer at that moment — but the value of DNS monitoring is the comparison, and a one-off query has nothing to compare against. Upcheck costs $10 per month for the workspace plus $1 per website per month, and that dollar covers all four checks on the website: DNS every 6 hours, uptime every 5 minutes, the SSL certificate every 12 hours, and the domain registration daily.
Hear about the change before the traffic moves.
Add the domains you own, point the alerts at your team, and let every lookup be compared against the last.