DNS (Domain Name System) monitoring is an automated way of checking whether a domain name is being correctly translated to a corresponding IP address. When a DNS server doesn't respond or when the searched domain doesn’t return the right IP address, the DNS monitoring spots the issue and alerts the right person on the development team.
In this article, you will learn the following:
The DNS monitoring process works by sending automated requests to the desired
DNS server and checking the results for a specific domain name. The most
common use case is querying the DNS server with a URL and checking the returned
IP address returned in the A Record or AAAA Record.
The desired response for those queries is the correct IP address corresponding
to the used URL. For example, when checking the URL google.com, we are looking
for a response that includes IP 172.217.23.238.
When the correct IP is received no further action is taken and the monitoring continues. When a different one is returned, the monitor starts what is called a DNS incident and starts alerting according to the on-call calendar.
To check a DNS server for specific domain records you can use the DNS checker tool. In the results look for the record type you are interested in (see the example below).
There are several providers of DNS servers, the most commonly used are:
8.8.8.8 and 8.8.4.41.1.1.1 and 1.0.0.1208.67.222.222 and 208.67.220.220DNS servers store much more than just domain to IP translations. The most commonly used DNS records are:
172.217.23.238. It's important to monitor that the record matches the IP and vice versa. Non-matching data can signify an error or spoofing attack.2606:4700:3108::ac42:285e. It should be also checked regularly that it matches the records.A DNS incident is a period of time during which a given DNS is unavailable or returns incorrect records.
A DNS incident can be also a situation where the request sent by the monitor doesn’t receive a response in a given time frame. The request timeout can be anywhere from 5 seconds to 1 minute, depending on the priority of the monitor.
After an incident is spotted by the DNS monitor it needs to be communicated to the service admins. This process is called incident alerting or on-call alerting. This is because, in case of an incident, the person from a team who is currently on-call (has scheduled duty) receives the incident alert.
The most common types of getting alerted by a DNS monitor include automated phone calls, SMS, Slack, and Microsoft Teams messages. Ways of alerting depend on factors like the importance of the monitored service, time of the day, and team preference.
After an alert is received it should be acknowledged immediately. If the alert is not acknowledged in a specified time frame (usually 3 minutes), the person next in line on the on-call duty is alerted. This process could continue further until the whole team is alerted. The best practice however is to have the on-call schedule set up in a way that the first team member is always ready to solve incoming incidents.
Once the incident is acknowledged the escalation process is paused and the team can fully focus on solving it. The speed by which an alert is acknowledged is called Time to acknowledge (TTA). Its average from different incidents called Mean Time to Acknowledge (MTTA) is a widely used incident management metric.
The next steps in the incident resolution process are individual to different teams and apps. For larger teams, they can include collaborations between a few developers or even teams of developers, delegations of incidents to dedicated team members, and more. There are some best practices that should be used by all teams managing incidents. These include incident communication (both internal and external) and incident post-mortems.
Monitoring of DNS increases your service reliability and security. It is very efficient in the detection of some common hacker attacks. There are two well-known attacks, which can be detected by DNS monitoring:
DNS monitoring is one of the more advanced synthetic monitoring options. It’s commonly used by advanced users as a tool for monitoring potential hacker attacks.
When it comes to website monitoring, DNS checks should be set up after basic uptime monitoring (ideally accompanied by SSL certificate and domain expiration checks).
When setting up a DNS monitoring tool it might be useful to also explore other advanced monitoring options like API or TCP/UDP port monitoring.
Better Uptime is an infrastructure monitoring
tool that offers reliable DNS monitoring. Here is how to get notified whenever a
Cloudflare DNS server doesn’t return 172.217.23.238 IP for google.com query.
1.1.1.1 to
check the Cloudflare DNS servergoogle.com as the domain that will be checked172.217.23.238 in the Keyword to find in the DNS response to check
the DNS response for this IPFor more information, explore Better Uptime docs.
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.