Enhanced Zone Health Checks

Beyond Simple Record Diffs

Diffing a zone catches modifications, but it doesn't catch a DMARC policy that was never set in the first place, an SPF record that ballooned past the ten-lookup limit, or a CAA record that's silently allowing every CA on the internet to issue for your domain. Enhanced health checks evaluate the actual security posture of your zone — not just whether records changed since yesterday.

What's Monitored

Each monitor runs on its own schedule and produces a pass / warn / fail result with explanatory detail. Failures and regressions fire through every notification channel.

CAA

Verify that only your authorized certificate authorities can issue for your domain. Catch missing CAA records and accidental wildcards.

DMARC, DKIM, SPF

Parse and validate every email-auth record: missing DMARC policy, weak p=none, SPF lookup overflow, broken DKIM selectors.

HSTS

Confirm the HSTS header is present, has a sane max-age, and is preload-eligible if you've opted in.

Google Safe Browsing

Detect when any of your domains land on the Safe Browsing blocklist — usually the first sign of a compromise.

Domain Lock Status

Verify the registrar lock is engaged so a hijacker can't transfer the domain even with stolen credentials.

Nameserver Health

Check IPv4 and IPv6 reachability for every authoritative nameserver, plus consistency across the NS set.

Tuned to Your Zone

Health monitors auto-provision when you add a zone, with sensible defaults you can tighten or loosen per zone. Disable a monitor for a zone where it doesn't apply, change check intervals on the Control plan, and let the results flow into the same alerting channels you already use for record changes.

Available on Protect and Control Plans

Enhanced zone health checks are included on the Protect and Control plans. Start your free trial and we'll provision the full monitor set on every zone you add.