Domain and DNS checks: DNSSEC, CAA, blacklists

Domain and DNS

These checks run on the domain; CAA additionally per host name with a certificate.

dns DNS records: A, AAAA, CNAME, MX, TXT, NS and CAA, preferably at the authoritative name server, canonicalised as a snapshot for change detection. NXDOMAIN and SERVFAIL are critical (dns_failed), a zone without A, AAAA, CNAME and MX a warning (dns_empty), each after two runs. A CNAME next to other records is a warning without an incident. Single record changes are events, name server and MX changes warnings. Only records of the queried name count: A records of a CNAME target are no violation, and a subdomain without NS records of its own belongs to the zone above (no warning).
dnssec DNSSEC: DS record in the parent zone and validation via a validating resolver, signature expiry, deprecated algorithms. A failing validation is critical (dnssec_bogus, two runs) because Google, Cloudflare and Quad9 then cannot reach the domain. Signatures expiring in under 7 days are a warning, under 2 days critical (dnssec_expiring); the warning only applies if less than a third of the validity period remains, so that providers with short signatures do not cause false alarms. Without DNSSEC there is a hint.
domain Registration: expiry date, registrar, EPP status and name servers according to the registry via RDAP, once a day. Expiry in under 30 days is a warning (domain_expiring), under 60 days a hint; expired or not registered critical (domain_expired); clientHold/serverHold critical (domain_hold). A missing transfer lock is a hint. Registries without an expiry date (DENIC for .de) only deliver status and name servers. A registrar change is reported as a warning.
blacklist Blacklists: the IPv4 addresses of the website and the first five MX hosts against Spamhaus ZEN, Spamcop, Barracuda and PSBL, the domain name against Spamhaus DBL and SURBL. A listed mail server IP or domain is critical, a listed website IP a warning (blacklist_listed, one run). Only unambiguous listing responses count; the removal is reported as an all-clear.
caa CAA: CAA records including parent and wildcard rules, compared with the certificate authority of the current certificate on port 443 (around 30 CAs known). No CAA record is a hint; a record that locks out your own CA a warning (caa_blocks_issuer) because the next renewal would fail; invalid records caa_invalid, each after two runs.
nameservers Name servers: every NS of the zone needs an address, must answer, be authoritative and serve the same state of the zone. Dead, lame and addressless servers as well as a server with a different serial and different data (SOA values, NS, MX, TXT, CAA, A/AAAA without a shared address) open nameservers_broken after two runs; if none answers it is critical. A different serial with the same data (anycast providers such as Google count it per server) is only a hint; an incomplete data comparison counts as an incomplete run. A single name server, all in the same /24 network or spread over several providers are hints. The run has a 20-second budget and starts at a rotating position; incomplete runs are marked.

See also: DNS monitoring · Domain monitoring

Zone backup: what the outside check cannot see

The DNS check queries the monitored names from outside, like any resolver. Records under other names – internal hosts, service records, verifications – are invisible to it. If the DNS provider of the domain is connected, the zone backup fills that gap: every night it reads the whole zone at the provider, shows the changes in the DNS tab under “Zone backup” and only notifies about what the outside check does not report anyway. Every state can be downloaded as a zone file and restored with a click.