DNS change auditor
A small system that takes an hourly snapshot of every DNS zone the business relies on, shows each change as a plain diff, and asks one person whether it was intended. It watches the mail records with particular care, because those break quietly and expensively. It cannot change a record. Seven posts on the same system — one diagram at a time — with a cost breakdown and an engineering reference at the end.
- 01
A DNS change auditor on AWS for a few dollars a month
The whole system on one page — a snapshotter, a differ and a confirmer — and the split between records that appear in a digest and records that alarm.
- 02
How a zone gets snapshotted
How to build the list of names to check when you cannot enumerate a zone, which record types are worth querying, and why two resolvers matter.
- 03
How a DNS change gets described
Turning a record diff into a sentence somebody will actually read, why the consequence belongs in the message, and the specific changes worth explaining.
- 04
How mail records get watched
Why the four mail records break silently, what a change to each actually does, and the one mail check that is not a diff at all.
- 05
How a DNS change gets confirmed
The one-tap confirmation, the daily digest for everything else, what an unconfirmed change escalates to, and the number that says whether the critical list is right.
- 06
What the dns change auditor costs
About $5 a month. One Bedrock read per check hour is the only line that grows; the queue, the table, the mail and the storage are rounding errors. Plus the three ways the bill could surprise you.
- 07
Engineering reference: the dns change auditor architecture
Same system, drawn purely for engineers. Service names, region, Lambda inventory, IAM scopes, the schemas and the exact model id.
Frequently asked questions
- What is a DNS change auditor?
- A small serverless system that snapshots your DNS zones hourly, diffs each snapshot against the last, and puts unexpected changes in front of a person. It is read-only: it cannot create, change or delete a record.
- Why watch DNS at all?
- Because a DNS change is the fastest way to break something completely and the slowest thing to notice. A wrong MX record loses mail silently. A removed SPF include makes your invoices arrive in junk folders. Neither produces an error anybody sees.
- Does it stop somebody making a change?
- No, and it should not. Changes are legitimate and frequent. What it does is make every one of them visible within the hour to somebody who can say whether it was meant, which is what does not currently happen.
- What are critical records?
- The handful you nominate that should essentially never change: the apex A record, the MX records, the SPF and DMARC records, and the nameservers. Those get a stricter path: any change alarms immediately rather than appearing in a digest.
- What does it cost to run?
- Around a dollar a month. It is a few DNS queries an hour. See part six.