Should I monitor DNS separately, or is an HTTP check enough?

Should I monitor DNS separately, or is an HTTP check enough?

Q: If my site responds, doesn't that prove DNS works? Why add a separate DNS monitor?

A: Usually yes — until it isn't. A reader running only HTTP checks got a clean bill of health while a chunk of users couldn't reach the site at all. The cause: their registrar pushed a config change that dropped one of two authoritative nameservers. Resolvers that cached the good one were fine; resolvers hitting the dead one failed.

Their HTTP monitor resolved through a healthy nameserver, so it stayed green for the entire 3-hour event. Support tickets revealed roughly 18% of traffic was affected.

They added a DNS monitor that queries each authoritative nameserver directly and checks the returned records match expected values. The next registrar hiccup was caught in 4 minutes.

The follow-up: also alert on unexpected record changes, not just resolution failure. A wrong-but-resolving record (a hijack or fat-fingered edit) is worse than a timeout, and a plain up/down check won't see it.

Got a question? Drop it in the comments.