Provider change
A new CDN or DNS host
Set the new addresses as expected before the switch; a record missing from the new zone fails the check.
DNS monitoring
DNS monitoring: alerts when your domain resolves to the wrong answer, from 300+ locations
HostTracker resolves your hostname from 300+ checkpoints in 158 cities, as often as every minute, and compares the answer with the IP addresses you expect. A name that stops resolving or points somewhere else fails the check, re-checked from other locations before anyone is alerted.
30-day trial · 100 monitors · checks every minute · no credit card
- Trusted since 2004
- 500,000+ websites monitored
- 300+ checkpoints worldwide
How a wrong DNS answer becomes a confirmed alert
The answer you expectList up to 10 IP addresses per monitor. An answer with none of them fails the check as an unexpected IP.
Resolved where your users areEach of 300+ checkpoints in 158 cities resolves the name itself, as often as every minute.
Confirmed before it alertsA failed check is re-run from up to seven other locations, and the majority decides.
How DNS monitoring works on HostTracker
There is no separate DNS monitor type: HTTP, API, ping and port monitors resolve the hostname first and judge the answer before the request, ping or connection.
A MONITOR WITH EXPECTED IPS, THROUGH THE API
POST /monitor { "type": "http", "url": "https://shop.example.com", "interval": 60, "locations": { "pools": ["allworld"] }, "settings": { "expectedIps": [ "203.0.113.10", "203.0.113.11" ] } }
The answer you sign off on
Switch on Expected IPs Validation and list up to 10 IPv4 or IPv6 addresses. An answer holding at least one goes on, and the check connects only to a listed address; an answer holding none fails as an unexpected IP address.
Resolved by the checkpoint, or by servers you name
Each checkpoint uses its own resolver, or a monitor switches to its country's public DNS servers or to up to 4 servers of yours.
Confirmed like any outage
A wrong answer is a Down result: re-run from up to seven other locations, decided by the majority, then alerted. The website monitoring service behind it
Verdicts
What counts as a DNS failure, and how it is confirmed
The last row may be one checkpoint's own resolver failing, so it needs more witnesses.
| What the checkpoint sees | Result | Before the alert |
|---|---|---|
| The name does not exist, or has no address record | Down: domain not found | Re-checks, majority decides |
| Addresses come back, none of them on your list | Down: unexpected IP address | Re-checks, majority decides |
| The resolver answers 0.0.0.0, the usual blocklist answer (HTTP and port) | Down: blocked by the resolver | Re-checks, majority decides |
| The resolver fails (SERVFAIL) or does not answer | Not counted; another checkpoint retries | Down once three checkpoints in a row cannot resolve it |
Each result records the resolved address the check connected to and how long the lookup took, so a DNS problem is told apart from a server problem.
Monitor types
Four monitors that carry DNS checks
Pick the monitor by what should happen after the name resolves; all four take the same DNS settings.
Monitor
After the DNS answer
Plans
Requests the page from a listed address and judges it as usual. The list also covers hosts a redirect leads to.
Every plan
Sends your request and asserts on the response, the DNS answer included.
Plans that include API monitors
Pings a listed address: the right host, and it answers.
Every plan
Connects to the port on a listed address: the right server accepts mail, SSH or database traffic.
Every plan
Use cases
Six DNS problems worth a monitor
In each, the server is healthy and visitors still cannot reach it.
Security
A hijacked record
A record changed at the registrar or DNS host sends visitors elsewhere while your server stays up; the answer stops matching.
Renewals
An expired domain or zone
A lapsed domain stops resolving or lands on a parking address; both fail. Domain expiration monitoring warns before it lapses.
GeoDNS
Different answers per region
GeoDNS and split-horizon setups answer by location. List every regional address, or give each region its own monitor.
Migration
One region still on the old server
A monitor pinned to that region fails until its resolvers hand out the new address; the propagation checker shows every location at once.
Country rules
Blocked in one country
With the country's public DNS servers, a 0.0.0.0 answer or an address that is not yours fails the check.
Resolvers
Choose which DNS servers do the resolving
Three modes per monitor, under DNS Server Selection; the pricing table shows which plans include the last two.
The checkpoint's own resolver
Each checkpoint uses its own DNS servers, the answer a user on that network gets. No setup needed.
Public DNS servers of the checkpoint's country
Each checkpoint picks public resolvers in its country that pass a benchmark of known domains. If none answers it falls back to others, and an alert backed only by fallback answers is held. Servers you exclude are skipped.
DNS servers you name
Up to 4 server IPs, queried from every checkpoint; your authoritative nameservers work for names they answer with an address record. If they fail, the monitor goes down once other checkpoints confirm it.
Limits
What DNS monitoring here does not check yet
- DNSSEC. No check validates signatures, the chain of trust or signature expiry. Validating resolvers answer SERVFAIL when signatures fail (RFC 4035), so the monitor may report a DNS failure, but it never names DNSSEC as the cause.
- Other record types. Monitors resolve address records (A and AAAA). MX, TXT and CNAME are in the instant lookups only; NS, SOA and CAA are not queried.
- TTL and nameservers. TTLs are not tracked, and a nameserver change alerts only when the answer itself changes.
- Mixed answers. Expected IPs fail only when no returned address is listed. To fail on any stray address, add this assertion rule to an HTTP or API monitor, on plans that include assertion rules:
dns.ips in ["203.0.113.10", "203.0.113.11"].
DNS monitoring tools
Instant DNS lookups for the moment an alert arrives
Monitors watch on a schedule; these answer once, from many locations, with no account needed.
DNS propagation checker and DNS lookup
A, AAAA, CNAME, MX and TXT records from public resolvers near each checkpoint.
MX lookup
A domain's mail servers, and whether they answer.
CNAME lookup
Where a hostname points.
TXT record lookup
SPF, verification and other TXT records.
The DNS lookup guide explains record types, TTL and propagation. DNS blacklist monitoring is a different product: it watches whether your IP or domain is on spam blocklists, not what your name resolves to.
Plans and prices
What DNS monitoring costs
Expected IPs come with every plan. Figures and resolver options are read from the live plan catalog.
| Complete | Webmaster | Business | |
|---|---|---|---|
| Price | $9 a month or $99 a year | $14 a month or $149 a year | $29 a month or $299 a year |
| Monitors | 10, all on one website and its subdomains | 10 | 25 |
| Fastest check | 1 minute | 5 minutes | 1 minute |
| Check types | All 14 monitor types | 9 of 14 monitor types (no API, transaction, page speed, server load or SNMP) | 13 of 14 monitor types (no SNMP) |
| Expected IPs | Included | Included | Included |
| Public DNS servers of the checkpoint's country | Included | Not included | Included |
| Your own DNS servers (up to 4) | Included | Not included | Not included |
Your own DNS servers are included on Complete. Public DNS servers of the checkpoint's country are included on Complete and Business.
Enterprise plans and full feature lists are on the pricing page.
30-day money-back on your first payment · your price stays while your subscription stays active
Switching services
Bring your monitors over in one paste
The importer creates the matching checks from your current service's export; add expected IPs afterwards.
Paste the export into the New monitor panel
UptimeRobot, Pingdom, StatusCake, Better Stack, Site24x7 and Uptime Kuma exports are read directly, or paste a list of URLs. Anything without an equivalent is listed with the reason, never dropped silently.
THE IMPORTER READS
export UptimeRobot Pingdom StatusCake Site24x7 Better Stack Uptime Kuma or URLs https://example.com
Start the 30-day trial first (100 monitors, no credit card) and confirm your email - the importer opens once the address is confirmed. HostTracker is not affiliated with any company named on this page; product names are trademarks of their owners.
Every layer of your stack, monitored
Websites, servers, APIs, certificates. One check type per page, the same locations, alerts and reports behind all of them.
Trusted by teams at
The full guide
Running DNS monitoring well
Every chapter opens in place, so the page stays short.
Setting up DNS monitoring in five steps
- Run the DNS propagation checker on the hostname to see what each location gets now.
- Add an HTTP, ping or port monitor and switch on Expected IPs Validation; Resolve IPs automatically fills in today's answer for you to check.
- Under DNS Server Selection, keep the checkpoint's resolver or pick another mode your plan includes.
- Choose locations: all regions, or one monitor per region where GeoDNS answers differ.
- Subscribe contacts and set each one's delay.
Expected IPs with CDNs, GeoDNS and redirects
CDNs. A CDN hostname whose addresses rotate is a poor fit for a fixed list; pin expected IPs on the origin hostname instead.
GeoDNS. Each checkpoint gets its own region's answer. List every address any region may receive, up to 10, or create one monitor per region, pinned to its locations.
Redirects. On an HTTP monitor the list applies to every host a redirect visits. Monitor the final URL, or list each host's addresses.
DNS monitoring tools: lookup, propagation checker or monitor?
A DNS lookup asks one resolver what it returns now. A propagation checker asks resolvers in many places at once, showing where a change has arrived. A DNS monitor repeats the question on a schedule, compares the answer with what you expect, and alerts when it changes. The first two diagnose; the third tells you before your users do.
Key takeaways
Key takeaways
- HostTracker has no separate DNS monitor type: HTTP, API, ping and port monitors resolve the hostname from 300+ checkpoints in 158 cities and judge the answer first.
- Expected IPs validation takes up to 10 IPv4 or IPv6 addresses per monitor; an answer containing none of them fails as an unexpected IP address, and the check connects only to a listed address.
- A wrong, missing or 0.0.0.0 answer is re-checked from up to seven other locations and the majority decides; a resolver failure counts only when three checkpoints in a row cannot resolve the name.
- A monitor resolves through the checkpoint's own resolver, the public DNS servers of the checkpoint's country, or up to 4 DNS servers you name; the last two depend on the plan.
- DNSSEC is not checked, and monitors resolve only A and AAAA records; MX, TXT and CNAME answers are in the instant lookup tools.
Frequently Asked Questions
Checking on a schedule, from outside your network, that a hostname still resolves to the right addresses. HostTracker does it from 300+ checkpoints in 158 cities inside HTTP, API, ping and port monitors, and alerts when resolution fails or changes.
Switch on Expected IPs Validation and list up to 10 addresses. An answer with none of them fails as an unexpected IP address, is re-run from up to seven other locations, and alerts once the majority agrees. The check only connects to an address on your list.
A name that does not exist or has no address record, an answer with none of your expected addresses, and a 0.0.0.0 answer from a blocking resolver count as Down, confirmed by re-checks. A resolver failure at one checkpoint does not count alone; when three checkpoints in a row cannot resolve the name, the monitor goes down.
Yes, on plans that include custom DNS servers: name up to 4 server IPs and every checkpoint queries them instead of its own resolver; authoritative nameservers work for names they answer with an address record. If they stop answering, the monitor goes down once other checkpoints confirm it.
Not yet. No check validates signatures, the chain of trust or signature expiry. If signatures fail and the resolver in use validates them, it refuses to answer and the monitor reports a DNS failure, without naming DNSSEC as the cause.
A propagation checker answers once: what resolvers in many places return right now. HostTracker's checker does that for A, AAAA, CNAME, MX and TXT records, no account needed. A DNS monitor asks on a schedule, compares the answer with what you expect, and alerts when it changes.
On the monitor's interval, from every minute to once a day; the shortest interval depends on the plan. Alerts go by email, SMS, voice call, Slack, Microsoft Teams, PagerDuty, Telegram, Discord, Viber, Mattermost, Pushover, Pushbullet, browser push or webhook, each contact with its own delay: immediately, after 3, 5, 15, 30 or 60 minutes, or after 3, 6, 12 or 24 hours.
Complete costs $9 a month or $99 a year for one website and its subdomains, with every check type; Webmaster $14 a month for 10 monitors checked every 5 minutes; Business $29 a month for 25 monitors checked every minute. Enterprise plans cover larger fleets. Expected IPs are included on every plan. Every account starts with a 30-day trial of 100 monitors, no credit card. 30-day money-back on your first payment.
30-day trial - 100 monitors - no credit card
DNS monitoring that checks the answer, not only that there is one
Expected IPs on HTTP, API, ping and port monitors, resolved from 300+ checkpoints, every failure confirmed by a majority of up to seven locations.
- Trusted since 2004
- 500,000+ websites monitored
- 300+ checkpoints worldwide
Part of HostTracker's website monitoring software.
30-day trial - no card needed
Start the 30-day trial