DNS Diff monitors

Detect any unplanned change to a DNS answer — hijacks, mistaken edits, and provider drift.

A DNS Diff monitor records the answer it gets, then compares every later answer against it. When the answer changes, the monitor moves to the CHANGED status and alerts fire.

It is a security and change-detection control, not an availability check.

Configuration

There is no expected value — that is the point. The baseline is whatever the first successful lookup returned.

The CHANGED status

CHANGED is deliberately sticky. It does not clear itself when the answer settles, because “the record changed and then stopped changing” is exactly what a successful hijack looks like. A human has to look at the new value and accept it:

POST /monitors/<monitor-id>/dns/acknowledge

Acknowledging adopts the current answer as the new baseline and returns the monitor to UP. In the dashboard this is the Accept change action on the monitor.

What it catches

• A registrar or DNS account compromise repointing your domain.
• A colleague editing a record without telling anyone.
• A provider silently changing the addresses behind a managed record.
• A failover that fired when you did not expect one.

Expect legitimate noise

Some records change constantly by design and are a poor fit:

• Records behind a CDN or global load balancer that rotate addresses.
• Very low-TTL failover records.
• ANY lookups against providers that reorder answers between queries.

Watch the specific record type you care about rather than the whole name, and prefer names whose values are meant to be stable — your apex, your NS, your MX.