10 years of ZoneWatcher

ZoneWatcher shipped its first version in October 2016. The idea was simple: if a DNS record changes, you should hear about it before your customers do.

That idea hasn't changed. What's around it has.

More hands on DNS. A zone used to be touched by one or two admins. Now it's touched by marketing tools adding verification records, SaaS onboarding flows, Terraform, and lately AI agents with API keys making changes no human reviewed. Each one is a reasonable change, and together they're a mess nobody owns.

Attacks moved up the stack. Hijacking a domain usually doesn't take breaking DNS itself. It takes a phished registrar login, a dangling CNAME pointing at a deleted cloud resource, or an expired domain someone else picks up. All of those show up as changes, and you can catch them if you're watching.

Certificates expire faster. The CA/Browser Forum voted to shrink public TLS certificate lifetimes to 47 days by 2029. More renewals means more chances for one to quietly fail.

Auditors ask now. SOC 2, ISO 27001, and newer rules like NIS2 and DORA expect you to show who changed what and when. "We think it was Dave" isn't an answer anymore.

So ZoneWatcher grew too. It went from email alerts on a few records to full zone sync across about 50 DNS providers, certificate and domain expiry monitoring, an audit trail, risk scoring on every change, and approvals for teams that want a second pair of eyes before anything ships.

Ten years in, the advice is the same: know what's in your zone, and know when it changes.

Thanks to everyone who's used ZoneWatcher along the way. Here's to the next ten.