Features
Resources
DNS Provider Sync · Cloudflare
Cloudflare hosts your zone. DNS Spy watches it. Connect with a read-only API token and every record — including proxied ones — is monitored from resolvers around the world, with alerts the moment anything changes.
No credit card required · 7-day trial · Read-only API access
Cloudflare's proxy is its superpower — and a trap for naive monitoring. A proxied A record stores your origin IP in the Cloudflare dashboard, but every resolver on the planet answers with Cloudflare edge IPs. A tool that compares your zone file to the API would flag every proxied record as "wrong," forever. DNS Spy uses the Cloudflare API only to discover which records exist; the values it monitors come from live queries against your authoritative nameservers. You monitor what your users, your mail, and your certificates actually see — the edge — while still getting complete record coverage from the API.
Cloudflare zones accumulate records: verification TXTs from services you tried once, CNAMEs for tools you no longer use, subdomains someone spun up for a demo. DNS Spy imports the full list and keeps a versioned history of every record's value over time — so you can audit what exists, see what changed and when, and get alerted when a record you forgot about suddenly starts resolving differently. If a token with write access is ever compromised, the change shows up in your alerts, not in your incident retro.
Cloudflare's audit log records who changed what — if you remember to look, and if you have the plan tier that retains it long enough. DNS Spy watches from the outside: when a record stops resolving on your nameservers, you get an alert within minutes, regardless of who deleted it or why. Provider sync never removes a record from monitoring just because it vanished at Cloudflare — a silently disappearing record is precisely the event a DNS monitor exists to catch.
In the Cloudflare dashboard, go to Manage Account → Account API Tokens and create a token.
Scope the policy to "All Domains" (access to all domains within the account) so future zones are covered automatically.
Choose the "DNS & Zones" permission group and select only "DNS: Read" and "Zone: Read".
Paste the token into DNS Spy under Team Settings → DNS Providers, click Test Connection, then Import Domains.
Read more about how imports, recurring sync, and resolver-based monitoring work on the DNS Provider Sync feature page.
Create a read-only Cloudflare API token (DNS: Read + Zone: Read), connect it to DNS Spy, and import your zones. DNS Spy monitors every record from multiple resolver locations worldwide and alerts you via email, Slack, Discord, or PagerDuty when any record changes, disappears, or goes out of sync between nameservers.
Yes, correctly. Proxied records are imported from the API for coverage, but DNS Spy monitors the resolver view — the Cloudflare edge IPs the world actually sees — rather than comparing against the origin IP stored in your dashboard. That means no false "change" alerts on proxied records, ever.
Only on Cloudflare Enterprise, where outgoing zone transfers can be arranged. For everyone else, the API is the way to get a complete record list — which is exactly what DNS Spy's provider sync automates, with a token you can scope to read-only in two minutes.
DNS Spy keeps a versioned history of every record and its values over time, and you can export any zone as a BIND file, CSV, or PowerDNS format. It's not a restore button for Cloudflare, but it is a complete, timestamped record of what your zone looked like at any point — invaluable when you need to know what a record was before it changed.
The token you provide needs only read permissions — DNS Spy never writes to your zones. Tokens are stored encrypted and are never displayed again after saving. If the token stops working, DNS Spy pauses that connection and emails your team owner; resolver-based monitoring continues unaffected.
Connect with a read-only token, import every record, and get alerted the moment anything changes. Free for 7 days.
Cloudflare is a trademark of its respective owner. DNS Spy is not affiliated with or endorsed by Cloudflare.
Features
Resources