DNS Health Overview

DNS Health Overview

Continuous DNS zone-health monitoring in Prometheus + Grafana. Think intoDNS or Zonemaster — but run on a schedule against your own zones and graphed over time, so delegation breakage, SOA drift, missing glue, or a broken SPF/DMARC record shows up on a dashboard (and in alerts) instead of only when you remember to run a one-off web check.

Pairs with dnshealth_exporter, which walks each zone's delegation from the root servers and publishes dnshealth_* metrics.

What it shows

Delegation & authority

• Parent vs. child NS agreement, stealth (undelegated) nameservers, per-NS responsiveness
• Parent glue IPs vs. the addresses the authoritative servers actually report
• SOA serial consistency across primaries, MNAME validity
• IPv6 nameserver coverage

Mail (collapsible section)

• MX — Null MX (RFC 7505), CNAME-in-MX misconfiguration, primary/backup priority
• SPF — presence, the multiple-record PermError, terminal all qualifier, and the RFC 7208 §4.6.4 ten-lookup budget
• DMARC — presence and policy

Every status cell is four-state — PASS / FAIL / WARN / N/A — with a gray N/A when a check genuinely doesn't apply (e.g. an unreachable zone), so a lame delegation doesn't masquerade as a pile of red failures.

Operator views (collapsed) — probe-cycle duration, DNS query rate, SOA serials over time, query latency.

Requirements

• Grafana 11+
• A Prometheus scraping dnshealth_exporter

Setup

1. Import the dashboard and select your Prometheus datasource.
2. Use the Zone dropdown (top-left) to choose a zone — it's populated automatically from dnshealth_query_success.

Exporter setup, a runnable demo stack, and the full metric reference live at https://github.com/SJrX/dnshealth_exporter.

Other catalog fields

• One-line summary: Continuous DNS zone-health monitoring (delegation, glue, SOA, SPF/DMARC/MX) — intoDNS/Zonemaster as a live Prometheus dashboard.
• Suggested tags: dns, prometheus, monitoring, spf, dmarc, dns-health
• Collector/datasource: Prometheus