Daily Screenshots
The fastest way to spot a defaced page, a takeover, or a forgotten app is to look at it. DNS Watchdog looks at all of them, every day, so you don't have to.
Plenty of DNS problems are invisible in the records but obvious on the screen: a parked page where your product used to be, a default server placeholder, a login portal that should never have been public, content that simply is not yours. Someone glancing at every hostname daily would catch all of it - but nobody has that job, so nobody does it.
DNS Watchdog does. Every hostname serving web traffic is photographed daily with a headless Chromium browser at full desktop resolution, with pages given up to 30 seconds to load. Screenshots are then grouped by perceptual hash - a 64-bit fingerprint of the page's visual structure rather than its exact pixels - so the twenty subdomains behind one load balancer collapse into a single entry with a count, and reviewing hundreds of hostnames takes minutes.
The grouping is also the change detector: when a record starts serving different content, its screenshot stops matching its group and it stands alone - which is exactly where your eye goes. Spot something wrong and you can flag it into an issue directly from the screenshot, with your description attached, feeding the same review workflow as every automated finding.
How it works
- IdentifyThe daily port scan finds every record answering web traffic, and hostnames that load successfully are queued for capture.
- CaptureEach hostname is photographed with headless Chromium at desktop resolution, with up to 30 seconds allowed for the page to load - real rendered pages, not blank loading states.
- GroupA 64-bit perceptual hash fingerprints each screenshot's visual structure. Identical pages group together, with the most recent capture as the representative.
- Surface changeWhen a hostname's content changes, its screenshot no longer matches the group and it appears separately - unexpected content announces itself.
- ActFlag any screenshot into an issue with a description. It lands in the same triage workflow as automated findings, linked to the underlying record.
What you get
- Automatic daily capture of every web-serving hostname
- Rendered in headless Chromium at desktop resolution, with time to load properly
- Visual-similarity grouping and perceptual-hash deduplication
- Content changes break records out of their group, so they stand out
- Flag any screenshot straight into a tracked, triaged issue
- Navigate from any screenshot straight back to the DNS record behind it
Why it matters
Visual ground truth
Records tell you where a name points; a screenshot tells you what is actually being served there. Defacements, takeovers, and parked pages are obvious in a thumbnail and invisible in a zone file.
Hundreds of hosts, minutes of review
Deduplication collapses identical pages into single entries - one thumbnail with a ×20 badge instead of twenty identical ones - so daily review is genuinely quick.
Changes announce themselves
You do not compare yesterday's screenshots to today's; the grouping does. Anything that changed is the thing sitting outside its group.
A visual archive of your estate
Daily captures build a browsable record of what every hostname served and when - invaluable for investigations and for answering 'what was running there?' after the fact.
Common questions
What gets photographed?
Every DNS record serving web traffic, discovered by the daily port scan - hostnames that respond and load successfully are captured. There is no list to maintain: if a record starts serving web traffic, it starts being photographed.
How does the visual grouping work?
Each screenshot is reduced to a 64-bit perceptual hash representing its visual structure rather than exact pixels, so minor rendering differences do not split groups. Screenshots with matching hashes are grouped, with the newest capture shown as the representative - and clicking into a group reveals every record sharing that visual.
What do I do if I spot something wrong?
Open the screenshot and flag it. You describe the problem and DNS Watchdog raises an issue linked to the underlying record - triaged, tracked, and resolved through the same workflow as every automated finding. Flagging the same record again updates the existing issue instead of duplicating it.