6DNS and mail checks

A DNS monitor checks that your domain's records say what they should. The same monitor type also checks your email security records. It can also tell you if your servers are on a spam blocklist.

DNS (the Domain Name System) is the internet's address book. It turns names such as acme.io into addresses and settings. Each piece of information is a record, and each record has a type.

Every check in this chapter is a DNS monitor. You choose what it checks in the record type list:

Record type	What it checks	Section
A, AAAA, CNAME, MX, TXT	A DNS record and its value.	6.1
SPF, DKIM, DMARC	Your email security records.	6.2
BLACKLIST	Whether your addresses are on a spam blocklist.	6.3

Create a DNS monitor#

In the top navigation, select + new monitor.
Select the dns tab. The page title changes to new dns monitor.
Enter a name, such as acme.io DNS.
Choose a check interval. The default is 60 seconds. Your plan's minimum still applies.
Under locations, choose the regions to check from. If your team has alert channels, choose them under on failure — notify.
In domain, enter the name to check, such as acme.io or www.acme.io.
Choose the record type. The default is A.
If you want, add expected values (the values the record must contain). Select + add expected value for each extra value.
Select create monitor →.

After the monitor exists, open it, select Edit, then select run once now (3.6) to run a check at once. The result appears on its own.

Enter the name only. https://, a port, a path or a space gives the message "Domain only — no scheme, port or path".
An empty domain gives "A domain is required".
Empty expected-value rows are removed when you save. Spaces at the start and end of a value are removed too.
You can change the record type later. You cannot change the monitor type.

Create a DNS monitor through the API#

Call CreateDnsMonitor with your API key (chapter 13). The fields are name, domain, recordType, expectedValues (a list of text values), intervalSeconds, locations, alertChannelIds, timeoutMs and assertions.

Create a DNS monitor

bash

export OBSRVLY_KEY=obs_...
SVC=https://www.obsrvly.com/api/gw/monitor/obsrvly.v1.MonitorConfigService

curl -s $SVC/CreateDnsMonitor \
  -H "Authorization: Bearer $OBSRVLY_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "acme A", "domain": "acme.io",
       "recordType": "A",
       "expectedValues": ["76.76.21.21"],
       "intervalSeconds": 300}'

recordType is required in the API. There is no default. Upper or lower case both work, so cname is saved as CNAME.
To list the record types you can use, call ListDnsRecordTypes with the body {}. It needs no API key. It returns {"recordTypes": [...]}.
To change a monitor, call UpdateMonitor with a config. Send every field. Fields you leave out are removed.
To read results, call ListExecutions with {"monitorId": "...", "limit": 20}. Each result has status, responseTimeMs, errorMessage, location, executedAt and metadataJson.

The API returns these messages for a wrong request:

Message	What to do
`domain required`	Send a `domain`.
`record_type required`	Send a `recordType`.
`record_type must be one of A, AAAA, CNAME, MX, TXT, SPF, DMARC, DKIM, BLACKLIST`	Use one of the listed types.
`domain name is longer than 253 characters`	Use a domain of 253 characters or fewer.

A monitor name can have at most 200 characters.

Timeout and response time (API only)#

Timeout: a lookup waits up to 5 seconds by default. To change it, send timeoutMs through the API. The most you can set is 60 seconds. A larger value acts as 60 seconds. The dashboard has no timeout field for DNS.
Response time: the only assertion a DNS monitor uses is response_time_ms (chapter 4). For mail checks, the response time is how long the whole check took. The assertion runs only when the check itself passes.

Fail when the lookup takes 500 ms or more

"assertions": [
  {"type": "response_time_ms",
   "op": "ASSERTION_OP_LT", "value": "500"}
]

The operators are ASSERTION_OP_EQ, ASSERTION_OP_NEQ, ASSERTION_OP_GT and ASSERTION_OP_LT. A failed assertion shows assertion response_time_ms <op> <n>: got <ms>. You can also set a slow-response limit on the edit page (3.1).

When a check fails#

A failed check shows as down with a message. Each section below lists the messages. Whether you get an alert follows your alert policy (chapter 9).

Sometimes a result shows Could not run with this message: "The DNS lookup could not be run: our checker could not reach its DNS resolver. This is a fault on our side, not on your domain." You do not need to do anything. These results do not count toward uptime or alerts.