Steps
- Open the site and find DNS records. If the site has a DNS check, open What is watched on your host name and tick the groups you want, under Watch these records. New DNS checks watch name servers, mail servers, SPF, DMARC and CAA from the start; the other text records are off because they change often, and a check made earlier watches only the address records until you tick the groups.
- Press Save. The first reading comes within about 15 minutes and becomes the baseline; it is never reported as a change.
- When a change is confirmed, the section shows it with + for the records that were added and a minus sign for the records that were removed. If you made the change, press I know about this change; if you did not, check your DNS provider first.
How it is decided
- The records are read from two public resolvers, about every 15 minutes, from each region.
- A change is confirmed when two regions see the new records, or when one region sees them twice. The baseline then follows the new records, and going back later is a change of its own.
- A record that is not there is a valid answer: a name without CAA records or without a DMARC record is not a failure. A question that got no answer is treated as missing data, never as a change.
- Order, capital letters and TTL never count as a change.
What it does not do
It watches the name of the site and the DMARC name under it, not your whole zone. It does not test whether e-mail is delivered, does not read DKIM keys, and does not check DNSSEC. During a maintenance window an alert is held back (how).