DNS Monitoring for Every Nameserver

Likely cause: the zone is not in sync. A secondary stopped receiving zone transfers, or a provider you left is still in your NS records.

What to do: fix the transfer or remove the stale server from the delegation. Until every server agrees, recipients get different answers.

Likely cause: the server knows the zone but cannot answer, for example after a failed zone load or with a broken DNSSEC signature.

What to do: check the provider's status and the zone on that server. Resolvers move on to the next server, so e-mail keeps flowing while only one fails.

Likely cause: the server is not configured for this zone, or blocks queries from outside its network.

What to do: add the zone to the server or remove it from your NS records.

Likely cause: a lame delegation. Your NS records name a server that does not host the zone, typically left over from a provider switch.

What to do: update the NS records at your registrar and in the zone so they list only servers that serve it.

Likely cause: the name exists on the other nameservers but not on this one, usually a half-deployed change such as a new DKIM selector added at one provider only.

What to do: add the record on the lagging server or wait for the zone transfer. Until then, recipients that hit this server do not find it.

Likely cause: a network issue, a firewall dropping UDP port 53, or an overloaded nameserver. Each lookup is retried once with a longer timeout before it is shown as timed out.

What to do: if the same server times out check after check, look at its reachability. A timeout never counts as a removed record.

It depends on your plan, from every few minutes to once a day, always on every authoritative nameserver. Large zones are checked over several runs. "Check DNS now" runs a check on demand and shows its progress. Each record's details page shows the exact number of checks, when the last one ran and when the next one is due.

A, AAAA, CNAME, MX, NS and TXT records. SPF and DMARC are always monitored. Records behind a CNAME or in a delegated subzone are followed to the nameservers that actually serve them.

Every paid plan, starting with Mini. Plans differ in data retention, which is how far back you can open the history: 30 days on Mini, 90 days on Basic, a full year on Pro and Enterprise. Older changes are kept, locked, and open when you upgrade. Webhooks come with Basic and higher, the REST API and the MCP server with Pro and Enterprise.

Proxied A and AAAA records point at Cloudflare's edge and change on their own. Discovery skips them, and records tagged as proxied in an imported zone file are added paused.

Yes. Discovery adds SPF, DMARC, DKIM selectors, MX, MTA-STS, TLS-RPT and BIMI records automatically, and you can add any other A, AAAA, CNAME, MX, NS or TXT record by hand or import a zone file. Each record has its own monitoring state: monitored, paused (not checked), or muted (checked and kept in the history, without warnings or notifications). SPF and DMARC stay monitored; every other record you can pause, mute or remove at any time.