Our service
This page provides information of how the monitor service works, its different plans and its many features.
DNSmonitor is an easy-to-use, Internet based monitoring service, specifically designed to monitor public authoritative DNS servers and their domains. The service provides our customers with much needed visibility of their Internet facing domains and their DNS servers.
Service basics
The monitoring service runs at 5-minute intervals from three or more geographically separated monitoring locations. At each run the selected monitoring nodes perform a series of specially crafted DNS checks against the relevant name servers. The result from each check is evaluated and, depending on type of check, compared to the original data stored in our database.
The result of each check run is compiled, weighted and calculated into the Availability and Integrity metrics which is presented on the monitoring dashboard and through the API. Alerting events are triggered by the Availability and Integrity results and can be sent using our integrations to 3rd party services.
Basic plan
The Basic plan is our entry-level monitor scheme which performs a fixed set of checks every 5 minutes and aggregates them into an Integrity and an Availability metric.
The Basic plan provides aggregated Availability and Integrity results from each monitoring location. The Availability result is calculated after the checks UDP Availability check and TCP Availability check is run against the domains authoritative name servers. These checks provide valuable information about the domains ability to respond to queries over both UDP and TCP.
The Integrity result is calculated from the result of the SOA Serial number check, the SOA MNAME check and the Delegation consistency check. The checks provide information to validate that the zone synchronisation is correct and that the parent-child delegation records are identical.
Basic plan
The Basic plan is our entry-level monitor scheme which performs a fixed set of checks every 5 minutes and aggregates them into an Integrity and an Availability metric.
The Basic plan provides aggregated Availability and Integrity results from each monitoring location. The Availability result is calculated after the checks UDP Availability check and TCP Availability check is run against the domains authoritative name servers. These checks provide valuable information about the domains ability to respond to queries over both UDP and TCP.
The Integrity result is calculated from the result of the SOA Serial number check, the SOA MNAME check and the Delegation consistency check. The checks provide information to validate that the zone synchronisation is correct and that the parent-child delegation records are identical.
Monitoring packages
Each domain that is monitored by the Basic plan can be customised by adding one or more monitoring packages. It can also be configured to monitor custom resource records to suit most requirements.
Availability
Monitor the availability of a zone and its ability to respond to DNS queries. This is checked on all authoritative name servers for the zone.
The availability of name servers and their ability to respond to queries for a domain is critical to any business. The availability of a domain also depends, directly or indirectly on factors like correct delegation information, number of configured name servers, network latency and quality.
Any given name server can be configured to host thousands of domains, but even minor misconfigurations can cause the name server to drop a domain. This makes standard service monitoring inadequate since it usually only monitors that the DNS service is up and running, but does not detect if one or more domain is dropped. DNSmonitor validates that the monitored domain is available and can respond to queries on all of its configured name servers.
The Availability check package consists of 8 different checks designed to check and monitor different aspects of DNS and domain availability. Some of these checks are informational in nature and do not effect the Availability metric,
By adding the Availability package to the Basic plan, packet drops (time-outs) will be included in the calculation of the Availability result.
The individual checks from the Availability package are detailed in the grid on the monitoring dashboard.To find out what each check does and which checks are included in the Availability package, please refer to the DNS check Knowledge Base.
Integrity
Monitor zone data integrity to ensure that each resource monitored record responds as expected.
The Integrity checks are designed to detect any modification of the monitored zone content. A modification could indicate a security breach or a possible DNS hijacking, unless it is a legitimate change. The Integrity checks will also check for obvious configuration flaws that potentially could lead to information leakage.
The Integrity package currently consists of 10 different checks, each designed to check and monitor different aspects of the zone integrity. During the initial configuration of the Integrity package, the configuration engine reads a selection of well-known records, including infrastructure records, and stores them in a non-volatile database. These stored records are then used as validation in subsequent check runs. If legitimate changes to these records are made at a later stage the database entries have to be updated by using the Reconfigure feature.
By adding the Integrity package, the NS IP address check and the CAA validation check will also affect the calculation of the Integrity result.
Each of the integrity checks are run against all public authoritative name servers for the zone to ensure the correctness on every server. The results are then displayed in detail in the grid on the monitoring dashboard.
For more technical details on which checks are included in the Integrity package and what they do, please refer to the DNS check knowledge base.
DNSSEC
Monitor that the DNSSEC features works as intended.
DNSSEC solves some of the inherited weaknesses of the DNS protocol. When implemented it renders cache poisoning attacks useless since the injected entries will fail validation. DNSSEC also adds an additional layer of trust by allowing the recipient to cryptographically validate each record set.
The DNSSEC monitoring package will validate each record that is looked up in the zone during each check run and report any problems. It will also check that the implementation conforms to the requirements and proposals published by the IETF in terms of algorithms, timers and configuration.
The DNSSEC monitoring package is only useful on signed zones.
Read more details about the DNSSEC package and what checks are included.
Mail/Spam
Monitor the integrity and availability of the domains email functions and its spam policies.
The DNS plays a critical role in the routing and policing of email services. The Mail package will monitor that the critical MX resource records are unchanged and resolvable. The results will also affect the calculation of the Integrity result.
The Mail package will also ensure that the SPF and DMARC records found in the zone apex remain unchanged. SPF and DMARC records should be present in all zones to combat spam and phishing. Due to its record construction with one or more selectors, DKIM records are not included in the mail package but can be added with the TXT Resource Record to complete the Mail policy monitoring.
Read more about the Mail package and its checks.
Premium plan
The Premium plan consists of a Basic plan bundled together with the Availability, Integrity, DNSSEC and Mail packages at a favorable price.
A Premium plan is a DNS troubleshooting and expert system all in one. The Premium plan is also future-proof!
As new features are added to the service, they will automatically be included in the Premium plan, while they will be available to the Basic plans at an additional cost.
When adding a third package to the Basic plan for a domain, it makes sense to switch to the Premium plan, not only to save money, but also to avoid missing out on important monitoring features.
Read all about the different packages and checks included in the Premium plan in the DNS check Knowledge Base.
Premium plan
The Premium plan consists of a Basic plan bundled together with the Availability, Integrity, DNSSEC and Mail packages at a favorable price.
A Premium plan is a DNS troubleshooting and expert system all in one. The Premium plan is also future-proof!
As new features are added to the service, they will automatically be included in the Premium plan, while they will be available to the Basic plans at an additional cost.
When adding a third package to the Basic plan for a domain, it makes sense to switch to the Premium plan, not only to save money, but also to avoid missing out on important monitoring features.
Read all about the different packages and checks included in the Premium plan in the DNS check Knowledge Base.
Resource Records
Each domain is unique in what it represents, its purpose and its content. By adding Resource records to monitor it is possible to customise the monitoring service to suit almost any domain.
Each added resource record is monitored for its existence in the zone and its RDATA fields are validated for correctness. Each resource record check will affect the Integrity metric. Adding resource records for monitoring is very simple. Add the name of the record, select the record type and the configuration engine will take care of the rest. The configuration engine will look up the record from the monitor locations that is configured for the domain. This is done to take into account any geo-location differences in query response and store them in the configuration database. The added record will be monitored from next check run.
The record types A, AAAA, PTR and CNAME are grouped under the Host selector. The configuration engine recognises which records type the record has and records it accordingly. This means that if a Host record resolves to both A and AAAA records both will be monitored as a single entity, including their in-addr.arpa and ip6.arpa counterparts. If the configuration engine finds a CNAME it will record and monitor the record as a CNAME.
Other resource record types that can be set up for monitoring include SRV, TXT, (including a special case for SPF1 record subtype), TLSA, CAA and NAPTR.
Find out more about the Resource Record checks.
Use the 14 day trial period to test our monitoring service without any commitments.
During the trial period you can configure up to three domains and switch back and forth between our Basic and Premium services, experiment with packages and a limited number of Resource records.
Geographic locations
Each domain is monitored from a minimum of three different monitoring locations. Monitoring locations can be moved and additional locations can be added.
A monitoring location is where the checks are performed from. By providing three different geographical locations we also give our customers a better basis for making informed decisions when they receive alerts. An alert doesn’t necessarily mean that a DNS is down if it’s indicated from one out of three locations. If all three locations show the same thing, there is a good chance that the name server is indeed down.
The choice of geographical locations may well reflect where the organisations clients come from. This gives the organisation an opportunity to configure and customise the monitoring to mimic its customer base.
Our current monitoring locations can be seen below.
9
Locations
8
Countries
4
Continents
Setup and configuration
The setup and configuration process is very simple and automated. Adding a monitoring object, such as a domain, requires only its name as input. Our automated configuration engine will do the rest, save the necessary data in the database and start monitoring the domain within seconds. For security reasons, we recommend that you validate that the results are what you’d expect.
Monitoring dashboard
Depending which plan a domain is monitored with, our monitoring dashboard provides a comprehensive view of the monitoring results for each domain. With its detailed drill-down views from each monitored location every check result from every name server can be viewed. The detailed messages provide helpful insight into how to remediate any issues found.
API
Using the API reduces the dependency of the web GUI. With the API you can perform all operations programatically and store the data locally on your preferred SIEM or monitoring platform. The Swagger generated API guide can be found here.
Alerts
The service can be configured to send alerts through our integration with PagerDuty. An active PagerDuty subscription is required.
Alerts are configured individually per domain and can be set to alert at individual severity levels for both Availability and Integrity.
Maintenance mode
Maintenance mode can be applied to each name server individually and stops the checks from querying that server. A server in maintenance mode is also excluded from the calculation of Availability and Integrity results.
Knowledge Base
The Knowledge Base provides extensive information about the DNSmonitor service and the DNS checks. The knowledge base also contains a wide range of useful DNS-related information. Check it out here.
Geo-sensitive RR checks
When adding resource record checks, the configuration engine resolves the names from the current geographical locations from which the domain is being monitored. This is to comply with any geo-aware domain and DNS configuration, if used.
Severity levels
We like to keep it simple. The monitoring system uses four different levels of severity: Information, Warning, Error and Unknown. This is compatible with most monitoring systems on the market.
GUI tour
Klick on the thumbnails below to take a virtual tour through our user interface or check out our Dashboard guide.
Standards and compliance
IANA RFC compliance
With more than 200 published RFCs directly or indirectly related to the DNS protocol, you’d expect all aspects of the protocol to covered. Unfortunately, this is not the case. Too many “shoulds” and too few “musts” have left vendors with a bit too much leeway when writing DNS code.
The service expects response to DNS queries to conform to IANA published RFC’s. If you experience false positives or false negatives from the check results, please report this to us and we will do our best to resolve it!
IPv4 and IPv6 support
It will still take some time but eventually the installation base of IPv6 will surpass the current IPv4 installation base. At DNSmonitor we firmly believe that the advantages of the IPv6 protocol will eventually prevail. Our monitoring platform is already IPv6 compliant and all our checks use both IPv4 and IPv6 where applicable.