Your clients don't care whose change broke their email — they call you. ZoneWatcher gives MSPs one place to watch every client domain across every DNS provider, with the client separation, security checks, and audit trail you need to catch problems before the phone rings.
Connect a client's DNS provider once and ZoneWatcher discovers every zone and record in the account — no spreadsheets, no manual entry. We integrate directly with the APIs of 50+ providers including Cloudflare, AWS Route 53, Azure DNS, Google Cloud DNS, GoDaddy, and No-IP, and re-check every zone continuously so changes surface within minutes.
Learn more about record auto-discovery →
Organize work the way your MSP does: separate teams per client or per business unit, each with its own members, providers, and notification rules. Granular roles cover your whole org — from admins to a billing-only seat — and the read-only Client role lets you give a client visibility into their domains only, scoped to exactly the providers you assign. SAML SSO, enforced two-factor authentication, and passkeys keep access under your control.
Every DNS change is versioned: what changed, when, and what the record looked like before. When a client's contractor "optimizes" a record on a Friday afternoon, you can pinpoint the exact change and the correct prior values in seconds instead of digging through old emails. Change history is retained from one to seven years depending on plan — long enough for even the strictest client audits.
Learn more about DNS change history →
ZoneWatcher continuously grades each domain against 13 health monitors: SPF, DKIM, and DMARC for email deliverability; DNSSEC, CAA, and domain-lock status for hijack protection; SSL certificate expiry and replacement coverage; HSTS; Google Safe Browsing flags; nameserver health and IPv4/IPv6 reachability; and registration expiry. When a client asks "is our email going to land in spam?", you already have the answer.
Learn more about zone health checks →
Not every alert deserves a ticket. AI-powered risk assessment scores each DNS change from 1–100 using geolocation and network analysis, so a routine TTL tweak reads differently than an MX record suddenly pointing at an unfamiliar mail host. Similar-domain detection watches for typosquatting registrations that target your clients' brands.
On the Control plan, ZoneWatcher goes beyond monitoring: stage DNS changes as changesets, require approval before they ship, watch propagation across global resolvers, and roll back a bad change with one click. Your techs get a change-management workflow for client DNS without touching each provider's console.
Route notifications to email, Slack, Microsoft Teams, Discord, Jira, GitHub Issues, HaloPSA, or any system via signed webhooks. Alert rules attach at the team, provider, or zone level, so each client's changes can flow to that client's channel — or into your ticketing workflow — instead of one noisy inbox. Maintenance windows snooze alerts during planned work while monitoring continues in the background.
Generate change audit reports as PDFs for client reviews and compliance requests, and export any zone to BIND, CSV, or Excel for migrations and backups. Everything your techs can see, your compliance reports can prove.
WHOIS monitoring tracks registration expiry, registrar changes, and transfer-lock status across every client domain, while certificate monitoring flags expiring SSL certificates before browsers do. With maximum certificate lifetimes now shrinking year over year, automated tracking is the only way to stay ahead of renewals at MSP scale.
A documented REST API covers zones, records, checks, certificates, and change history, with scoped tokens that can span one team or all of them. Onboard new clients, pull change data into your own tooling, or wire ZoneWatcher into your provisioning scripts.
Per-domain pricing with automatic volume discounts means small clients stay cheap and large portfolios earn better rates as you grow — no per-technician fees. See pricing and estimate your portfolio →
ZoneWatcher turns DNS from a liability you find out about from angry clients into a service you can package, prove, and bill for. Start your free trial today and put every client domain under watch in minutes.
Start your free trial today and get full access to all monitoring features.
