DNS has a cruel property: mistakes do not fail immediately. Resolvers cache the old answer for minutes or hours, so the person who made the change sees nothing wrong, goes home, and the site dies gradually overnight as caches expire around the world.
The usual suspects
- A/AAAA pointing at a server that was decommissioned during a migration.
- MX records lost when someone "cleaned up" the zone – e-mail silently bounces for days.
- NS changed at the registrar by a phishing attack or a well-meaning colleague – the whole domain now answers from somewhere else.
- A CNAME left pointing at a SaaS subdomain you no longer own (subdomain takeover).
Two ways to monitor DNS
Expected values: you tell the monitor which A or MX records must exist. Missing one is a confirmed failure and opens an incident. Use this for the records that must never change.
Drift detection: the monitor remembers the last set of records it saw and warns when anything differs – then adopts the new set as the baseline, so you are told once per change, not every five minutes. Use this for everything else: it is the cheapest early warning you can buy, and it catches the changes you did not plan.
Both run from our nodes, not from inside your network, so you see what the world sees – including the propagation you were waiting for.
