Notifications

DNS Watchdog sends notifications when scans detect changes to your DNS infrastructure — new records, deleted records, modified values, new security issues, and resolved issues. You can configure multiple notification channels so the right people are alerted through the right medium.

Supported channels

You can configure multiple instances of each channel type — for example, send critical alerts to a Slack channel and a detailed summary to an email distribution list.

When notifications are sent

Notifications are triggered when a scan completes and changes have been detected. The following scan types trigger notifications:

Notifications are suppressed during a provider's initial sync — the first time you connect a provider, all discovered zones and records are treated as baseline data rather than changes.

What's included in a notification

Every notification contains:

• Scan details — scan type, start/end time, who initiated it (user or system)
• Summary counts — number of changes grouped by category
• Top changes — the most security-relevant changes, prioritised with issues first
• Changelog link — direct link to the full changelog in DNS Watchdog

Change categories

Changes are grouped into the following categories:

Changes are sorted by security relevance — issues are shown first, followed by deletions, then additions and modifications.

Setting up a channel

Navigate to Settings → Notifications to manage your notification channels.

Choosing which changes trigger a notification

Every channel — Email, Slack, Microsoft Teams, Custom Webhook and SIEM — offers the same list of change types to notify on: the same list you filter by in the change log. When you add a channel, tick the change types you care about (for example, only Issue Detected and Record Deleted), or leave every box unchecked to be notified about every change type — the default, and how channels behaved before this option existed.

Each channel keeps its own selection, so you can send new issues to a PagerDuty webhook while a Slack channel receives everything. The list is defined once and shared across every channel and the change log, so the choices stay consistent wherever they appear and change together.

Email

1. Click Add Channel and select Email
2. Enter a label (e.g. "Security Team")
3. Enter the recipient email address in the configuration
4. Click Save

Email notifications are sent via Amazon SES and include both HTML and plain-text versions. The HTML version includes formatted tables showing before/after values for changed records.

Slack

1. Create an Incoming Webhook in your Slack workspace
2. Click Add Channel and select Slack
3. Enter a label (e.g. "#dns-alerts")
4. Paste the Slack webhook URL (must start with https://hooks.slack.com/)
5. Click Save

Slack notifications use Block Kit formatting with structured layouts for scan summaries and change tables.

Microsoft Teams

1. Create an Incoming Webhook connector in your Teams channel
2. Click Add Channel and select Teams
3. Enter a label (e.g. "DNS Monitoring")
4. Paste the Teams webhook URL (must start with https://*.webhook.office.com/)
5. Click Save

Teams notifications use Adaptive Card formatting with column-based layouts for change details.

Custom Webhook

1. Click Add Channel and select Webhook
2. Enter a label (e.g. "PagerDuty Integration")
3. Paste your HTTPS endpoint URL
4. Click Save

The webhook receives a structured JSON payload on every scan completion. See Webhook Payload below for the full schema.

SIEM (OCSF / CEF)

For Splunk, Microsoft Sentinel, Google SecOps (Chronicle), IBM QRadar, ArcSight or any other pipeline that speaks the Open Cybersecurity Schema Framework or the Common Event Format, add a SIEM (OCSF / CEF) channel instead of a webhook. It emits every finding and DNS change as a schema-conformant OCSF event — or, for collectors that expect it, a CEF line — in batches, with durable retries. Setup, the event mapping and per-SIEM ingestion notes are on the SIEM integration page.

Testing a channel

After creating a channel, click the Test button to send a test notification. This verifies that the endpoint is reachable and correctly configured.

The test payload for webhooks looks like:

{
  "event": "test",
  "message": "This is a test notification from DNS Watchdog. If you receive this, your webhook is configured correctly.",
  "settings_url": "https://app.dnswatchdog.io/settings/notifications",
  "source": "dns-watchdog"
}

Channel status

Each channel tracks its connection status:

When a channel enters the Error state after 3 consecutive failures, it remains enabled but is flagged for attention. Fix the underlying issue (e.g. expired webhook URL, invalid email) and send a test notification to reset the status.

Failures in one channel never block delivery to other channels — each channel is isolated.

SIEM channels are delivered asynchronously with retries, so their status reflects batches the collector has definitively accepted or rejected rather than a single request — see Delivery and retries.

Webhook payload

Custom webhooks receive a POST request with a JSON body on every scan that detects changes. The payload includes the same information delivered to email, Slack, and Teams channels.

Scan summary payload

{
  "event": "scan_summary",
  "source": "dns-watchdog",
  "scan_type": "daily_scan",
  "org_id": "org_abc123",
  "scan_id": "550e8400-e29b-41d4-a716-446655440000",
  "total_changes": 7,
  "scan_start_time": "2026-04-28T02:00:00+00:00",
  "scan_end_time": "2026-04-28T02:15:30+00:00",
  "initiated_by": "System",
  "initiated_by_email": null,
  "counts_by_group": {
    "issues_detected": 2,
    "issues_resolved": 1,
    "records_added": 3,
    "records_changed": 1
  },
  "changes": [
    {
      "change_type": "issue_detected",
      "entity_type": "record",
      "entity_name": "staging.example.com",
      "zone_name": "example.com",
      "record_type": "A",
      "hostname": "staging",
      "ttl": 300,
      "value": "203.0.113.50",
      "field_changes": []
    },
    {
      "change_type": "record_changed",
      "entity_type": "record",
      "entity_name": "www.example.com",
      "zone_name": "example.com",
      "record_type": "A",
      "hostname": "www",
      "ttl": 300,
      "value": "198.51.100.10",
      "field_changes": [
        {
          "field_name": "value",
          "old_value": "198.51.100.5",
          "new_value": "198.51.100.10"
        },
        {
          "field_name": "ttl",
          "old_value": "3600",
          "new_value": "300"
        }
      ]
    },
    {
      "change_type": "record_detected",
      "entity_type": "record",
      "entity_name": "api.example.com",
      "zone_name": "example.com",
      "record_type": "CNAME",
      "hostname": "api",
      "ttl": 300,
      "value": "lb.example.com",
      "field_changes": []
    }
  ],
  "changelog_url": "https://app.dnswatchdog.io/audit/changes?scan_id=550e8400-e29b-41d4-a716-446655440000"
}

Top-level fields

Change object fields

Each entry in the changes array has the following structure:

Change types

Field change object

For record_changed and issue_updated events, the field_changes array contains before/after diffs. An issue_updated whose review_status changes from resolved is a reopened issue, counted under issues_reopened:

Scanner metadata fields (port scan results, ISP data, HTTP status, etc.) are excluded from field-level diffs — only user-visible DNS record fields are included.

Managing channels

Enabling and disabling

You can enable or disable a channel without deleting it. Disabled channels skip delivery but retain their configuration.

Deleting a channel

Deleting a channel removes it permanently. The webhook URL or email address is also removed from secure storage.

Role required

Creating, updating, and deleting notification channels requires the Admin or Member role within your organisation. Read-only users can view channels but cannot change them. See Organisation for details on roles.