Change Tracking
DNS changes made outside approved workflows are how estates drift into trouble. DNS Watchdog reconciles every zone every day and shows you exactly what changed.
Your pipelines only see the changes that go through them. The record edited directly in a provider console during an incident, the entry added by an agency with portal access, the zone modified by a well-meaning colleague at 11pm - none of it appears in any approval trail. That out-of-band drift is precisely how careful estates decay into risky ones.
DNS Watchdog closes the gap by reconciling every zone across every provider, every day. Additions, modifications, and deletions are captured with git-style diffs - including changes made directly at the provider, outside your pipelines. Modified records get field-level before/after views: the old IP and the new one, the old TTL and the new one, side by side. Records deleted directly at the provider are recorded as external removals - a distinct category from deletions made through DNS Watchdog, because who removed a record matters as much as when.
The result is a complete, citable change archive. Filter by change type, zone, scan, or date range; deep-link to the changes for a specific zone or scan; and follow any scan from the history - with its duration, initiator, and change counts - straight to its changelog. Alongside it, a separate modification log tracks the operations initiated through DNS Watchdog itself, so 'what did we change?' and 'what changed?' each have a precise answer.
How it works
- SnapshotEvery zone across every provider is re-read during the daily scan - the complete current state, not a sample.
- DiffThe new state is compared against the last, producing field-level diffs: values, TTLs, and properties, old and new side by side.
- CategoriseEach change is classified - records detected, changed, deleted, or removed externally; zones appearing or disappearing; issues opened, resolved, or ignored.
- NotifyDetected changes flow into your notification channels, ordered with the security-relevant ones first.
- ArchiveEvery change lands in a filterable, deep-linkable log - by type, zone, scan, or date - giving every record a history you can scroll, search, and cite.
What you get
- Daily reconciliation of every zone across every provider
- Git-style, field-level diffs for additions, modifications, and deletions
- Out-of-band changes caught even when made directly at the provider
- External deletions recorded as their own category, not silently absorbed
- Filter and deep-link by change type, zone, scan, or date range
- A complete, citable change history per record
Why it matters
No more invisible changes
Whether a change came through your pipeline, a provider console, or a third party with access, it appears in the changelog. The scary category of changes nobody saw stops existing.
Incidents investigated in minutes
When something breaks, 'what changed?' is the first question. A filterable, diffed history per zone and record turns that from an archaeology project into a lookup.
Drift becomes visible
Small unauthorised changes accumulate into estate-wide risk. Seeing every out-of-band edit as it happens lets you correct course while it is still one record, not a pattern.
An audit trail that writes itself
Compliance frameworks expect changes to critical infrastructure to be tracked. A daily-reconciled, citable change history covers DNS without anyone maintaining a spreadsheet.
Common questions
Does it catch changes made directly at the provider?
Yes - that is the point. Detection works by reconciling the provider's actual state daily, not by watching your deployment pipeline, so console edits, third-party changes, and even external deletions are all captured and categorised as such.
What detail do I get for a modified record?
A field-level before/after diff: an IP changing from one address to another, a TTL dropping from 3600 to 300, old and new values side by side. New and deleted records show their full details, and issue changes show the type, severity, and affected record.
Can I see what one specific scan changed?
Yes. Scan history records every scan with its type, duration, and initiator, and links straight to the changelog filtered to that scan - so 'what did last night's scan find?' is one click.