Daily DNS snapshot diff against a stored baseline. Notifies when any watched record changes.

DNS Change Watch

Daily DNS snapshot diff against a stored baseline. Notifies when any watched record changes — useful for catching unauthorized DNS edits, registrar hijacks, or accidental config drift.

What it does

The monitor's check runs a bash script that:

Looks up each (domain, recordType) pair via dig +short.
Compares against the last-known state file ($INTOUCH_HOME/dns-state.txt).
On first run: establishes the baseline silently (no alert).
On subsequent runs: if diff finds any change, emits ALERT plus the unified diff lines, then rewrites the state file with the new snapshot.

The when: arm uses contains ALERT to gate notification.

Edit before installing

In monitor.yaml:

The WATCH=(...) array — each entry is domain TYPE (space-separated). Common record types: A, AAAA, MX, TXT, CNAME, NS, SOA.
STATE=... — path to the state file. Defaults to $INTOUCH_HOME/dns-state.txt. Override only if you need a custom location.
Schedule daily — DNS changes propagate slowly; hourly is overkill and produces spurious alerts during TTL-window transitions.

Bindings used

{{check.output}} — bash output: baseline message on first run, OK or ALERT + diff on subsequent runs.

Tools used

runtimeenv — core InTouch task type. Requires dig on the runtime environment's PATH (standard on Linux/Mac; install dnsutils / bind-tools if missing).

Previous form

Replaces the dns-change-detector job (deleted 2026-05-19). The monitor version uses the standard quiet-by-default pattern.

Watch-out

The state file lives on disk and persists across runs. If you delete it, the NEXT run becomes a fresh baseline (no alert) — useful for resetting after a legitimate DNS change you don't want to be re-notified about.