Know the moment your DNS drifts.

What DNS drift is.

DNS drift is the gap between what you believe your DNS says and what your nameservers answer today.

Records get added, changed and abandoned over months and years. Each change is small and most are harmless. DNS has no way to tell you when one of them is a mistake, so the gap grows until something breaks or someone else finds it.

How often to look.

Drift is silent, and its cost grows with the time it goes unnoticed. A dangling record can be claimed from the moment the resource behind it is released.

• After every change

  Confirm the edit reached every nameserver and that nothing else moved with it.

• Hourly, if you can

  Finds takeover exposure, stale secondaries and unplanned edits within the hour. A run over a few hundred names is a few thousand small queries.

• Daily, at the least

  Enough for the slow problems: signatures nearing expiry, SPF creeping toward its limit, a policy record that went missing.

An occasional check finds the slow rot. A frequent check catches an incident while it is still small.

Five kinds of trouble, one pass.

Each check has a stable ID, a severity, and the evidence behind it. No recursive resolver sits in the middle, so you see what the authoritative servers really say.

Light runHourly. Twenty-six checks across the whole fleet.

Deep checks, once a day.

Fourteen more checks that take extra queries per nameserver. Each one was chosen because its result changes over time, so the history shows when a zone went wrong as well as that it is wrong.

Deep runDaily by default, or on demand for a single zone.

After v1The deep checks are planned for the release after the first one. A diagram of each zone's DNSSEC chain, with before-and-after comparison across runs, ships with the first web UI.

How a run works.

The same five steps on every schedule tick, or once from the command line.

1. 1Walk from the root

   Follow referrals down to your zone and record the whole delegation path, glue included.

2. 2Ask every server

   Query each authoritative nameserver directly for each name and type, over UDP and TCP, IPv4 and IPv6.

3. 3Check

   Run the catalog against what came back: the light checks on every run, the deep checks once a day. Checks are pure rules over stored answers, so results are repeatable.

4. 4Snapshot

   Store the run in SQLite. Unchanged record sets are deduplicated, so years of history stay small.

5. 5Diff and alert

   Compare with the last run and your pinned baseline. Rotating CDN pools are recognised and kept quiet. You get one alert when a finding opens and one when it closes.

How it differs from existing tools.

Good tools exist for each part of this job. None of the open-source ones covers zone health, takeover exposure and drift history together while keeping your zone data on your own server.

The gaps it fills.

Six things the existing tools leave to you, and what zoneblick does about each.

• GapTodayWith zoneblick
• History across a whole fleet

  TodayZonemaster and DNSViz analyse one zone when you ask. They are not built to watch dozens of zones on a schedule and alert you when one changes.

  With zoneblickEvery zone is checked on a schedule. Each run is stored and compared with the last one, so you can see what changed and when.

• Health and exposure in one pass

  TodayZone-health tools do not look for takeover risk, and takeover scanners do not check delegation, serial sync or DNSSEC. You run two tools and reconcile two reports.

  With zoneblickBoth sets of checks run over the same answers and land in one list of findings, with one severity scale and one history.

• Monitoring you host yourself

  TodayMost services that track DNS changes over time are hosted. Your record inventory, including the list of dangling records, sits on someone else's server.

  With zoneblickOne binary on your own server. The data is a single SQLite file that you own and can back up, export or delete.

• Every nameserver, every transport

  TodayMany monitors ask a public resolver, or a single nameserver. A stale secondary, or a server that fails only over TCP or IPv6, goes unseen.

  With zoneblickEach authoritative server is queried directly over UDP and TCP, IPv4 and IPv6, and the answers are compared server by server.

• What the internet sees

  TodayConfig tools such as dnscontrol and OctoDNS confirm that your provider matches your config file. They do not see the parent's delegation, a lagging secondary or expiring signatures.

  With zoneblickResolution starts at the root and follows the real delegation, so the result is what a resolver would receive.

• Alerts you can leave on

  TodayA plain record diff fires every time a CDN or round-robin pool rotates its addresses, and people soon mute it.

  With zoneblickNames that rotate are recognised and tracked as pools. You are alerted when a finding opens and when it closes.

What it does not replace. The deep checks borrow a selected part of what Zonemaster and DNSViz do. Those tools still go further on a single zone, so findings link straight to them when you need a closer look. The takeover checks in zoneblick use the signature sets that the BadDNS, dnsReaper and Nuclei communities maintain.

Run it on your own server.

One binary, one config file, one SQLite file. There is no hosted version and no account to create.

zoneblick check example.org

# /etc/zoneblick/zoneblick.toml
[[zone]]
name  = "example.org"
seeds = ["www", "api", "mail"]

zoneblick serve

docker run -d \
  -v ./data:/data \
  -v ./zoneblick.toml:/etc/zoneblick.toml \
  -p 127.0.0.1:8053:8053 \
  zoneblick serve

In designzoneblick is not released yet. The commands above show the planned interface. The first milestone is the one-shot check command.