Continuous monitoring for DNS, certificates, and domains — with AI-powered risk scoring on every change and full change governance for the records you can't afford to fumble. Built for teams that can't be the last to know.
Direct integration with DNS service providers you already rely on
Don't see your provider? No problem! We have public DNS resolver integrations to support almost every need.
From change to alert in seconds
A record changes at your provider. ZoneWatcher captures the exact before-and-after, scores the risk with AI, and alerts your team where they already work.
A teammate, a script, or an attacker edits a record — often without anyone else knowing.
ZoneWatcher records the exact old and new values, so you always know precisely what changed.
DNS change detected in acme-corp.com
🔴 AI Risk Score: 87/100 (critical)
MX records now route mail through an unfamiliar network (AS394699, US → RU).
Total Records Changed: 1
View comparison →
A risk-scored alert lands in Slack, Teams, Discord, or Email — with the context to act immediately.
Core Platform
Records, certificates, nameservers, and registrations — monitored around the clock, with the history and integrations your team needs when something changes.
We check your zones every few minutes and store the exact before-and-after of every record change. No manual backups before a risky change, no guessing what the old value was.
Learn moreTrack SSL/TLS certificate expirations and new issuances. Certificate Transparency log monitoring detects unauthorized certificates across all your domains.
Learn moreDetect nameserver changes that could indicate a domain hijacking attempt or unauthorized transfer. Get alerted the moment your nameservers are modified.
Learn moreTrack WHOIS records for domain expirations, renewals, and registrar changes. Get alerts at 30, 14, 7, and 1 day before a domain expires.
Learn moreRecords sync straight from your provider's API — and when there's no API, we scan thousands of common subdomains to find them. No manual data entry.
Learn moreHear about changes moments after they happen, not from upset customers. Alerts go to Email, Slack, Microsoft Teams, Discord, JIRA, GitHub Issues, HaloPSA, and custom webhooks.
View setup guidesWe store every change to your DNS records. No more digging through old email threads or outdated technical documentation for the prior value.
Learn moreExport your DNS records to a BIND zone file or CSV for easy import into another provider — or an offline copy you control.
Create multiple teams with their own members, domains, and billing. Switch between them easily with a single account. Perfect for MSPs and agencies.
Need deeper integration? A modern JSON API gives you the raw data behind your DNS changes, ready for your own tooling.
Every DNS change is automatically analyzed by AI to assess security risk. Get an instant risk score from 1-100 with a detailed explanation so you know whether a change is routine or requires immediate attention.
AS394699 not previously seen
Protect plan
Lookalike domains, DNSSEC failures, and silent zone misconfigurations cause some of the worst DNS incidents — and the cheapest ones to prevent. ZoneWatcher's Protect tier surfaces them before they become outages or phishing campaigns.
Continuously scan for newly-registered lookalike, typosquatted, and homoglyph domains targeting your brand. Get alerted the moment a phishing-ready domain appears so you can act before customers do.
Learn moreWatch every signed zone for DNSSEC validation failures, expiring DS records, and chain-of-trust breaks. Catch the misconfigurations that take resolvers offline before they take you offline.
Learn moreContinuous zone-level checks beyond record drift — orphaned records, dangling CNAMEs, suboptimal TTLs, and misaligned MX/SPF/DKIM/DMARC — surfaced with actionable remediation guidance.
Learn moreNow in Beta BETA
Stop pushing record changes straight at the provider and hoping for the best. Stage every change in a reviewable changeset, route it through approval, watch propagation roll across the internet in real time, and roll back the moment something looks wrong — all without leaving ZoneWatcher.
Batch record edits into a draft changeset, dry-run validate against your provider, send through approval, and apply on demand or on a schedule. Every change reviewable, every state notifiable.
Learn moreAfter every applied changeset, ZoneWatcher polls public resolvers around the world. See per-resolver status, first-seen timing, and a Propagated event when the change has truly landed everywhere.
Learn moreOne-click rollback of any applied changeset, plus Revert Change for individual checks. Both produce a reviewable draft — ZoneWatcher never reverses a change without a deliberate human step.
Learn moreSince 2016, thousands of MSPs, Agencies, and Companies have used ZoneWatcher to protect their DNS infrastructure.
Facing a SOC 2 examination or an ISO 27001 assessment? DNS monitoring, change logging, and real-time alerting map directly to the controls your auditors look for. ZoneWatcher generates the evidence for your audit automatically.
Pay only for what you monitor. Volume discounts kick in automatically as you grow.
Core DNS monitoring for teams that need visibility into their DNS infrastructure.
5 domain minimum
Estimated total for domains:
$/mo
$/yr
Effective rate: $/domain/mo
Monitoring plus security intelligence and compliance tooling for teams managing client or business-critical domains.
5 domain minimum
Estimated total for domains:
$/mo
$/yr
Effective rate: $/domain/mo
Everything in Monitor, plus:
Full platform for enterprises and MSPs that need governance, change management, rollback, and priority support.
5 domain minimum
Estimated total for domains:
$/mo
$/yr
Effective rate: $/domain/mo
Everything in Protect, plus:
Volume discounts apply automatically. See pricing tiers
Need something custom? for special pricing!
On our monitoring plans, ZoneWatcher is strictly read-only — we watch your records and never create, edit, or delete them, so a scoped read-only token is all we need, and we recommend one where your provider supports it. The one exception is the Control plan's change management and rollback features, which apply approved changes back to your provider and therefore need write access. Either way, your credentials are encrypted at rest and never exposed.
Every zone is checked every 5 minutes. Our system runs continuously, queuing checks every minute so your records are scanned as soon as their next check is due — unauthorized changes are typically detected within minutes.
Your free trial gives you full access to every monitoring feature (5 days on most plans, 7 days on the Control plan). A card is collected securely by Stripe at signup and is never submitted to our servers — you won't be charged until the trial ends, and you can cancel anytime before then.
We integrate directly with provider APIs whenever we can, but you're never locked out: our Public DNS provider monitors your records through the public DNS system, so it works with any provider. Want a native integration? Email support@zonewatcher.com and we'll take a look.
We support Email, Slack, Microsoft Teams, Discord, custom Webhooks, GitHub Issues, Jira, and HaloPSA. You can configure multiple channels per team and choose exactly which event types each channel receives.
Have more questions? Read our full FAQ.
Start your free trial today and get full access to all monitoring features.