Real-Time Alerts
A finding nobody sees is a finding nobody fixes. DNS Watchdog routes findings into the channels your team already watches, as soon as each scan completes.
Detection is only half the job - the other half is making sure the right person sees the finding while it still matters. DNS Watchdog delivers scan results into the tools your team already lives in: Slack messages formatted with Block Kit, Microsoft Teams Adaptive Cards, HTML email, and structured JSON webhooks for everything else - your ticketing system, your SIEM, or your own automation.
Every notification is built for fast reading: the scan's details, summary counts by category, and the most security-relevant changes first - new issues lead, followed by resolutions and deletions, then additions and modifications - with a direct link to the full changelog. You can run multiple channels of each type, so the on-call Slack channel, a security distribution list, and a webhook into your automation can all receive deliveries independently.
Just as important is what does not get sent. Notifications fire only when a scan actually detects changes; a provider's initial sync is treated as baseline rather than broadcast as hundreds of 'new' records; and internal scanner metadata is excluded from diffs, so a timestamp shuffling is never dressed up as a change. Channels are isolated - a failing webhook never blocks your email - each has a test button, and a channel that fails three deliveries in a row is flagged for attention rather than silently dropping alerts.
How it works
- Scan completesDaily scans, provider re-syncs, and record rescans all conclude with a comparison against the previous state.
- Changes groupedDetected changes are grouped - issues found, issues resolved, records added, changed, and deleted, zones added and removed - and ordered with the security-relevant changes first.
- Formatted per channelThe same substance renders natively everywhere: Block Kit in Slack, Adaptive Cards in Teams, HTML with plain-text fallback in email, structured JSON on webhooks.
- Delivered independentlyEvery configured channel gets its delivery in isolation - one endpoint failing never holds up the others.
- Linked to detailEach notification links straight to the full changelog for that scan, so from alert to investigation is one click.
What you get
- Native Slack (Block Kit), Microsoft Teams (Adaptive Cards), and email notifications
- Custom webhooks with a structured JSON payload for anything in your stack
- Multiple channels per type, each delivering independently
- Changes ordered by security relevance: new issues first, always
- Initial provider syncs baselined, not broadcast - no day-one alert storm
- Per-channel test button and health status, with failures flagged after three strikes
Why it matters
Findings meet your team where they work
Nobody logs into another dashboard on a good day. Alerts in Slack, Teams, and email put findings in front of people inside the tools they already have open.
Signal without the fatigue
Notifications only fire on real changes, ordered security-first, with scanner noise filtered out and initial syncs baselined. The alert channel stays worth reading - which is the whole point of an alert channel.
Automation-ready
The webhook payload carries the scan type, counts by category, and the changes themselves as structured JSON - ready to open tickets, page on-call, or feed a SIEM without screen-scraping.
Reliable by design
Isolated per-channel delivery, a test button for every endpoint, and explicit error states after repeated failures mean you find out when an alert path breaks - instead of discovering it during an incident.
Common questions
What triggers a notification?
A completed scan that detected changes - new or resolved issues, records added, changed, or deleted, zones appearing or disappearing. Scans that find nothing new send nothing, and a provider's first sync is treated as baseline data rather than a wall of alerts.
Can different teams receive alerts in different places?
Yes. You can configure multiple channels across all four types - the on-call Slack channel, a security email list, a Teams channel, and a webhook can all be active at once, each enabled, tested, and monitored independently.
What does the webhook payload contain?
A structured JSON body with the scan type and timing, who initiated it, total changes, counts grouped by category, and the changes themselves with field-level diffs, plus a link back to the full changelog. It is designed to be consumed by ticketing systems, paging tools, and SIEMs directly.