Features
Resources
Feature · All Paid Plans
Your DNS provider already knows every record in your zone. Connect it to DNS Spy with a read-only API token and monitor all of them — imported in one step, kept in sync automatically.
No credit card required · 7-day trial · Works with every paid plan
When you add a domain to any DNS monitoring tool, the first question is: which records should it watch? Miss a record, and changes to it are invisible — no alert when it breaks, no alert when someone tampers with it.
Autodiscovery probes hundreds of common names — www, mail, _dmarc — and catches most of a typical zone. But the record you named something unusual three years ago? No wordlist will ever guess it. Zone transfers (AXFR) return everything, but they require a DNS host that allows them plus nameserver IP whitelisting — and most popular managed DNS providers don't offer AXFR at all.
The records most likely to be missed are exactly the ones you most need watched: the odd ones, the forgotten ones, the ones an attacker would love to quietly change.
DNS Provider Sync closes that gap by going to the source. Your provider has the complete list. DNS Spy asks for it.
Mint an API token at your provider with the minimum scope. DNS Spy's connection form shows the exact dashboard path and permissions for each provider.
Paste the token into Team Settings → DNS Providers. Test Connection verifies it instantly and shows how many zones DNS Spy can reach. Tokens are stored encrypted.
DNS Spy lists every zone in the account. Select the ones to monitor — each imports with its complete record inventory and starts scanning from resolvers worldwide.
DNS Spy re-reads the provider on a recurring schedule. New records appear in monitoring within hours of being created — nobody has to remember to add them.
Every integration uses the smallest token scope the provider offers, and each one handles the provider's quirks correctly — because we built and tested against every API individually.
Scoped API token — "DNS: Read" + "Zone: Read"
Proxied (orange-cloud) records handled correctly: DNS Spy monitors the edge IPs the world actually sees.
Cloudflare DNS monitoring guide →Account access token
Works with both user and account tokens — DNS Spy resolves the account automatically.
DNSimple DNS monitoring guide →Personal access token — read-only domain scope
Full support for DigitalOcean's @-style apex records and zone conventions.
DigitalOcean DNS monitoring guide →Account API key
Bunny-specific records (Pull Zones, redirects, scripts) are recognized and handled sensibly.
Bunny DNS DNS monitoring guide →Personal access token — "Domains: Read Only"
Supports Linode's separate SRV service/protocol fields and default-TTL semantics.
Linode / Akamai DNS monitoring guide →Personal access token
Optionally restrict the token by source IP in your Vultr account for extra safety.
Vultr DNS monitoring guide →Provider names are trademarks of their respective owners. DNS Spy is not affiliated with or endorsed by these providers.
Three principles keep provider connections trustworthy.
Provider APIs tell DNS Spy which records exist. What those records answer is always measured against your live authoritative nameservers, from multiple regions. You monitor reality, not a control panel.
A record removed at your provider stays under monitoring until you say otherwise. DNS Spy alerts you that it stopped resolving — because a silently disappearing record is exactly the event you pay a DNS monitor to catch.
Connections use the smallest scope each provider offers, tokens are encrypted at rest, and they are never shown again after saving. If a token stops working, DNS Spy pauses that connection and emails the team owner — monitoring itself keeps running.
Autodiscovery guesses; your provider knows. Importing the record list from the source means obscure, unusually named records — the ones wordlists can never find — are monitored from day one.
Every A, AAAA, CNAME, MX, TXT, SRV, CAA, NS, and more, exactly as configured at your provider. If it exists in the zone, it exists in your monitoring.
Teams add DNS records constantly — new services, new verifications, new subdomains. Provider Sync re-reads your account on a schedule, so records created next month are monitored automatically.
Each sync fingerprints the provider's record list and short-circuits when nothing changed, keeping API usage polite while catching every addition within hours.
Connect once, then import any number of zones with a checkbox list — each with its full record inventory. Already-monitored domains can be linked to the connection to gain record syncing.
Domain limits from your plan are respected during import, and the import page shows exactly which zones are new, already monitored, or already linked.
New to DNS Spy? Choose "Import from your DNS provider" when adding your first domain and your very first scan starts with a complete record inventory instead of an educated guess.
Pick your provider, paste a token, choose a domain from the list — monitored in under two minutes.
Monitor 60+ record types across all authoritative nameservers.
40+ automated security checks with weighted scoring.
Look-alike domain detection and brand protection.
Track WHOIS changes and domain expiration dates.
Certificate discovery, expiration tracking, and TLS auditing.
Organize domains by client, environment, or business unit.
Email, Slack, Discord & PagerDuty alert channels.
Connect Claude & AI agents to your DNS monitoring.
DNS Provider Sync connects DNS Spy directly to your DNS provider's API — Cloudflare, DNSimple, DigitalOcean, Bunny DNS, Linode/Akamai, or Vultr. Instead of guessing which records exist through autodiscovery, DNS Spy reads your complete record list from the provider, imports every record into monitoring, and re-checks the provider on a schedule so records you add later are discovered automatically.
The minimum the provider offers — read-only wherever the provider supports it. Cloudflare tokens need only "DNS: Read" and "Zone: Read". DigitalOcean tokens can be scoped to read-only domain access. Linode tokens need only "Domains: Read Only". DNS Spy never writes to your DNS: the integration reads zone and record lists, nothing else. Tokens are stored encrypted and are never displayed again after you save them.
What DNS actually resolves. The provider API is used only to discover which records exist. The values DNS Spy monitors always come from live queries against your authoritative nameservers, from multiple locations worldwide. This matters: a proxied Cloudflare record returns your origin IP from the API, but the entire world sees Cloudflare's edge IPs. Monitoring the resolver view means you monitor what your users, mail, and certificates actually depend on.
DNS Spy alerts you — it never quietly drops the record from monitoring. Provider sync only ever adds records or restores previously-deleted ones. If a record disappears at the provider, DNS Spy notices it no longer resolves on your nameservers and raises a change alert. Catching accidental (or malicious) deletions is the core of DNS monitoring, so deletion detection stays with the resolvers.
Every six hours by default. Each sync compares a fingerprint of your provider's record list against the last import, so unchanged zones are processed instantly. When new records appear at the provider, they are imported and monitored within the next sync cycle — no manual work required.
Autodiscovery probes hundreds of common record names — it catches most records but can miss unusually named ones. AXFR zone transfers return everything but require a DNS host that supports them plus nameserver IP whitelisting, and most popular managed DNS providers do not offer AXFR at all. Provider Sync gives you AXFR-level completeness with API-token-level convenience: the provider already knows every record, so DNS Spy just asks.
Yes. After connecting a provider, DNS Spy lists every zone in your account. Tick the domains you want monitored and import them in one step — each arrives with its complete record list. Domains you already monitor can be linked to the connection so their record lists sync too.
Every paid plan, and trials get full access. Provider connections are managed by team owners and admins under Team Settings → DNS Providers.
Autodiscovery and AXFR still work with any DNS provider, so you can monitor domains hosted anywhere. More provider integrations are planned — Amazon Route 53 is next on the list. If your provider has an API, contact us and we'll consider it; the integration layer was built to make new providers fast to add.
Connect your DNS provider, import every record, and let monitoring coverage take care of itself. Free for 7 days on every plan.
Features
Resources