DNS monitoring

DNS monitors check that a given hostname resolves for a specific DNS record type, and can optionally confirm the resolved value matches what you expect.

How it works

DNS monitors run on the same prober fleet as ping and TCP monitors, with the same interval, region, and alerting options. A workspace without multi_region is dispatched to one effective region. When multi_region is enabled, you can select several currently available regions in the monitor form.

See Monitors, Prober regions for how multi-region results combine into one status.

Configuration

Field	Description
Host	Hostname to resolve, e.g. example.com
Record type	One of A, AAAA, CNAME, MX, TXT, NS
Expected value	Optional. If set, the check passes only when one of the returned records contains this value as a substring
Check interval	How often to run the lookup. The monitor form enforces the current workspace minimum.
Alert threshold	Consecutive failures before triggering an alert. Default: 2

The monitor type and record type are fixed once the monitor is created, the same as ping monitors.

Use cases

• Domain migrations: confirm an A or CNAME record still points where it should after a DNS provider or hosting change.
• Mail deliverability: watch an MX or TXT (SPF/DKIM) record to catch it being accidentally removed or changed.
• DNS propagation and expected values: set an expected value to alert if a record drifts from what it should be, not just whether it resolves at all.

Plan availability

DNS monitors count toward the workspace monitor quota. Check frequency and the number of active regions use the same Uptime entitlements as other monitor types. See the pricing page for current limits.

Limitations

• Resolution only, not content verification. A DNS monitor confirms a record resolves (and optionally contains a substring you specify). It does not verify the service at that address is reachable or healthy: pair it with an HTTP, ping, or TCP monitor for that.
• Substring match only. The expected-value check looks for your value as a substring within a returned record; it is not a regex or exact-match comparison.
• No DNSSEC validation. The check resolves the record; it does not validate DNSSEC signatures.

FAQ

What happens if the record type doesn't apply to the host, or the domain has no records at all? If the resolver returns zero records of the selected type, the check is down.

Can I check for a specific IP address for an A record? Yes. Set the expected value to the IP address; the check passes only if one of the returned A records contains it.

Does DNS monitoring check SSL certificates? No. DNS monitoring only resolves DNS records. Use an HTTP monitor with SSL monitoring enabled for certificate-expiry checks.