DNS Record Monitoring

DNS record monitoring watches your domain's DNS records for unexpected changes. Whether someone accidentally modifies an MX record, a DNS provider makes an unauthorized change, or a domain hijacking attempt alters your A records -- Hoppla detects it and notifies you immediately.

How It Works

On the first check run, Hoppla queries your domain's DNS records and stores a baseline snapshot. On every subsequent run, it queries the records again and compares them against the stored snapshot. If any records have been added, removed, or changed, Hoppla saves a new snapshot and sends a notification.

Change Detection

Hoppla normalizes DNS records before comparison to avoid false positives:

• TTL values are ignored -- TTL changes alone do not trigger a notification.
• Record ordering is normalized -- DNS round-robin reordering does not count as a change.

Only actual content changes to record values trigger a change notification.

Address-record change mode

A record (dns_a_change_mode) controls how changes to address records (A/AAAA) are treated, so that routine CDN edge-IP rotation does not flood you with false alerts:

• auto (default) -- Hoppla distinguishes genuine address changes from the normal edge-IP rotation behind a CDN and only alerts on the former.
• strict -- Alert on any change to an A or AAAA record.
• ignore -- Never alert on address-record changes (other record types are still monitored).

Configuration

Setting	Default	Description
Record types	A, AAAA, MX, CNAME, NS, TXT, CAA	Which DNS record types to monitor. Supported: A, AAAA, MX, CNAME, NS, TXT, SOA, SRV, CAA. You can limit this to only the types you care about.
A-record change mode (dns_a_change_mode)	auto	How to treat changes to A/AAAA records: auto (ignore CDN edge-IP rotation, alert on real changes), strict (alert on any address change), or ignore (never alert on address records).
Check interval	12 hours	How often to query DNS records.

The check is zone-aware: it resolves the authoritative zone apex for the monitored host, queries each record type at the name where it actually lives (host-level records at the host; NS/SOA and inherited MX/TXT/CAA at the zone apex), and reads answers directly from the zone's authoritative nameservers.

Results

Each DNS check result includes:

• Status -- ok or fail
• Query time -- How long the DNS lookup took, in milliseconds
• Current records -- The full set of DNS records returned, grouped by type
• Zone & nameservers -- The detected authoritative zone apex and its authoritative nameservers (with resolved IPs)
• Propagation -- Cross-resolver consistency (authoritative nameservers vs public resolvers); flags mid-propagation/lame-delegation
• Nameserver changes -- A change to the zone's authoritative nameservers is surfaced distinctly (registrar/DNS-host migration or hijack signal) and emits the dns.nameserver_changed reseller webhook alias
• Snapshot ID -- Reference to the stored snapshot for this check
• Changes -- If records changed, a detailed diff showing the previous and current values for each affected record type

Example Change Output

When a change is detected, the result metadata includes a structured diff:

{
  "A": {
    "previous": [{"ip": "93.184.216.34"}],
    "current": [{"ip": "93.184.216.35"}]
  }
}

This makes it easy to see exactly what changed at a glance, both in the dashboard and in notification messages.

Alerts

DNS Failure

If the DNS lookup fails entirely (no records returned, or a server error), the check status is set to fail and an incident is created with the title "DNS check failed" and severity minor.

DNS Change Notification

When DNS records change, Hoppla sends a dns.records_changed notification. This is a separate event from the failure-based incident system -- DNS changes are informational and may be expected (e.g., after a migration). The notification includes the full diff of changed records.

DNS change notifications are controlled by the notify DNS changes setting on the monitor. You can disable them if you expect frequent, legitimate changes.

Automatic Resolution

If a DNS lookup failure resolves itself (records return on the next check), the incident is automatically resolved with the message: "DNS records are correct again."

Notification Events

Event	When
incident.created	DNS lookup failed entirely
incident.resolved	DNS lookup is succeeding again
dns.records_changed	One or more DNS records were added, removed, or modified
dns.nameserver_changed	The zone's authoritative nameservers changed