The Coverage Problem
When you add a domain to a DNS monitor, the first question is simple: which records should it watch?
Until now there were two answers, and both had a catch. Autodiscovery probes hundreds of common names — www, mail, _dmarc, the usual suspects — and it catches most of what real zones contain. But if you named a record something unusual, no wordlist in the world is going to guess it. Zone transfers (AXFR) give you everything, but only if your DNS host supports them and you are comfortable whitelisting IPs on your nameserver. Many popular providers simply do not offer AXFR at all.
So the records you most need watched — the odd ones, the forgotten ones, the ones an attacker would love to quietly change — were exactly the ones most likely to be missed.
The New Answer: Ask Your Provider
Your DNS provider already has the complete list. It is their job. So DNS Spy now connects to it directly.
Create a read-only API token at your provider, paste it into DNS Spy, and we will show you every zone in your account. Pick the ones you want monitored. We import the full record list for each — every A, AAAA, MX, TXT, CAA, SRV, and more — and start monitoring immediately. No guessing. No nameserver configuration.
And it is not a one-time import. DNS Spy re-checks your provider on a recurring schedule. Add a record at your provider next month and it shows up in your monitoring automatically, usually within six hours. Your coverage stays complete without anyone thinking about it.
Six Providers at Launch
Cloudflare — scoped API tokens with DNS: Read and Zone: Read
DNSimple — account access tokens
DigitalOcean — personal access tokens with read-only domain scope
Bunny DNS — account API keys
Linode / Akamai — personal access tokens with Domains: Read Only
Vultr — personal access tokens
Every connection asks for the minimum permission the provider offers — read-only wherever the provider supports it. Tokens are stored encrypted and are never displayed again after you save them.
Built for Monitoring, Not Mirroring
One design decision matters enough to explain. DNS Spy uses your provider's API to discover which records exist — but the values we monitor always come from live queries against your authoritative nameservers, from multiple locations around the world.
Why? Because what your provider's API says and what the world's resolvers see are not always the same thing. A proxied Cloudflare record is the obvious example: the API shows your origin IP, but every resolver on earth answers with Cloudflare's edge. If we treated the API as the source of truth, that record would look permanently broken. Instead, we import the record and then watch what actually resolves — which is what your users, your mail, and your certificates depend on.
The same principle protects you in the other direction. If a record disappears at your provider, provider sync will never quietly delete it from your monitoring. The record stays watched, DNS Spy notices it no longer resolves, and you get an alert. Catching accidental deletions is the whole point of DNS monitoring — so deletion detection stays with the resolvers, where it belongs.
From Your Very First Scan
Provider import is also built into onboarding. When you add your first domain to DNS Spy, you can choose "Import from your DNS provider" instead of autodiscovery, connect your account, and pick a domain from a list — so your very first scan starts with a complete record inventory instead of an educated guess.
How to Set It Up
For existing accounts, it takes about two minutes:
Go to Team Settings → DNS Providers and add a connection. The form walks you through creating the right read-only token for your provider.
Use Test Connection to confirm the token works — you will see how many domains we can reach.
Open Import Domains, tick the zones you want monitored, and submit. Already-monitored domains can be linked to the connection so they get record syncing too.
That is it. DNS Spy imports the records, scans them from resolvers worldwide, and keeps the list synced from then on.
Provider connections are available on every paid plan and during trials.
What's Next
More providers are coming — Amazon Route 53 is at the top of the list. If your DNS provider has an API and you want it supported, tell us. The integration layer was built to make adding providers fast, and the first six took exactly one day to ship.
Full DNS coverage used to require zone transfer support or a lot of manual record entry. Now it is a read-only token and two minutes of your time. Learn more on the DNS Provider Sync feature page, or connect your provider and let your monitoring watch everything.
Provider names are trademarks of their respective owners. DNS Spy is not affiliated with or endorsed by these providers.
