How to monitor domains and DNS
Monitor a domain by tracking its registration expiry and registrar through RDAP, and by snapshotting its DNS records (A, AAAA, MX, NS, TXT, CNAME) so any unexpected change alerts. Expired domains and changed nameservers or MX records take down websites and email at once. Vigil's Domain & DNS monitor does both.
What can go wrong with domains and DNS
- The domain expires. Auto-renew was on, but the card on file expired or the renewal email went to a former employee. The site, email and every API on the domain stop together.
- Nameservers changed. A registrar account compromise or a mistaken migration points NS elsewhere; traffic and email can be hijacked.
- MX or SPF changed. Email stops arriving or starts landing in spam; an SPF record that exceeds 10 DNS lookups fails with a permerror.
- A record drift. A record still points at a decommissioned server or a released cloud IP that someone else can now claim (subdomain takeover).
- DNSSEC breaks. An expired signature or a DS record left at the registrar after changing DNS provider makes validating resolvers return SERVFAIL.
The signals that matter, with alert thresholds
| Signal | Alert when | Why it matters |
|---|---|---|
| Days until registration expiry | ≤ 30 | Time to fix billing or transfer. |
| NS records | any change | Highest-impact change possible. |
| MX records | any change | Email delivery. |
| A / AAAA / CNAME | unexpected change | Traffic going somewhere else. |
| TXT (SPF, DMARC, verification) | unexpected change | Email authentication and domain proofs. |
| Registrar | changed | Transfer you did not start. |
Thresholds are starting points. Tune them after a week of data: an alert nobody acts on should be raised or removed.
How to check domains and DNS by hand
curl -sL https://rdap.org/domain/example.com | jq '.events[] | select(.eventAction=="expiration")'
whois example.com | grep -iE 'expir|registrar:'
dig +short NS example.com dig +short MX example.com
dig +short TXT example.com | grep spf dig +short TXT _dmarc.example.com
dig @1.1.1.1 +short A example.com dig @8.8.8.8 +short A example.com
How to watch domains and DNS with Vigil
- In New monitor pick Domain & DNS and enter the domain. Vigil reads expiry and registrar over RDAP (no whois scraping) and alerts 30 days before expiry by default.
- The same monitor snapshots A, AAAA, MX, NS, TXT and CNAME records and alerts on changes, showing the old and new values. Limit it to the record types you care about if some change by design.
- Add one monitor per domain you own, including redirect-only and email-only domains; they expire too.
- Check SPF, DMARC and DKIM in seconds with the free DNS and email-auth checker, and expiry with the domain checker.
Every alert goes to the channels you pick: email, Slack, Telegram, Discord, Microsoft Teams, Pushover, webhooks or on-call paging. Failures are confirmed by a second check before anyone is woken up.
domains and DNS monitoring FAQ
Isn't auto-renew enough?
Auto-renew fails quietly when the card expires, the registrar account is locked, or the notice goes to an old address. An independent expiry alert 30 days out is cheap insurance.
Will DNS-based load balancing cause false alerts?
If your A records rotate on purpose, limit the monitor to NS, MX and TXT, which should only change when you change them.
Why RDAP instead of whois?
RDAP is the structured, standard successor to whois, with machine-readable dates. Whois output differs per registry and is often rate-limited or redacted.