Notifications

DNS Watchdog sends notifications when scans detect changes to your DNS infrastructure — new records, deleted records, modified values, new security issues, and resolved issues. You can configure multiple notification channels so the right people are alerted through the right medium.

Supported channels

You can configure multiple instances of each channel type — for example, send critical alerts to a Slack channel and a detailed summary to an email distribution list.

When notifications are sent

Notifications are triggered when a scan completes and changes have been detected. The following scan types trigger notifications:

Notifications are suppressed during a provider's initial sync — the first time you connect a provider, all discovered zones and records are treated as baseline data rather than changes.

What's included in a notification

Every notification contains:

• Scan details — scan type, start/end time, who initiated it (user or system)
• Summary counts — number of changes grouped by category
• Top changes — the most security-relevant changes, prioritised with issues first
• Changelog link — direct link to the full changelog in DNS Watchdog

Change categories

Changes are grouped into the following categories:

Changes are sorted by security relevance — issues are shown first, followed by deletions, then additions and modifications.

Setting up a channel

Navigate to Settings → Notifications to manage your notification channels.

Email

1. Click Add Channel and select Email
2. Enter a label (e.g. "Security Team")
3. Enter the recipient email address in the configuration
4. Click Save

Email notifications are sent via Amazon SES and include both HTML and plain-text versions. The HTML version includes formatted tables showing before/after values for changed records.

Slack

1. Create an Incoming Webhook in your Slack workspace
2. Click Add Channel and select Slack
3. Enter a label (e.g. "#dns-alerts")
4. Paste the Slack webhook URL (must start with https://hooks.slack.com/)
5. Click Save

Slack notifications use Block Kit formatting with structured layouts for scan summaries and change tables.

Microsoft Teams

1. Create an Incoming Webhook connector in your Teams channel
2. Click Add Channel and select Teams
3. Enter a label (e.g. "DNS Monitoring")
4. Paste the Teams webhook URL (must start with https://*.webhook.office.com/)
5. Click Save

Teams notifications use Adaptive Card formatting with column-based layouts for change details.

Custom Webhook

1. Click Add Channel and select Webhook
2. Enter a label (e.g. "PagerDuty Integration")
3. Paste your HTTPS endpoint URL
4. Click Save

The webhook receives a structured JSON payload on every scan completion. See Webhook Payload below for the full schema.

Testing a channel

After creating a channel, click the Test button to send a test notification. This verifies that the endpoint is reachable and correctly configured.

The test payload for webhooks looks like:

{
  "event": "test",
  "message": "This is a test notification from DNS Watchdog. If you receive this, your webhook is configured correctly.",
  "settings_url": "https://app.dnswatchdog.io/settings/notifications",
  "source": "dns-watchdog"
}

Channel status

Each channel tracks its connection status:

When a channel enters the Error state after 3 consecutive failures, it remains enabled but is flagged for attention. Fix the underlying issue (e.g. expired webhook URL, invalid email) and send a test notification to reset the status.

Failures in one channel never block delivery to other channels — each channel is isolated.

Webhook payload

Custom webhooks receive a POST request with a JSON body on every scan that detects changes. The payload includes the same information delivered to email, Slack, and Teams channels.

Scan summary payload

{
  "event": "scan_summary",
  "source": "dns-watchdog",
  "scan_type": "daily_scan",
  "scope_id": "org_abc123",
  "scan_id": "550e8400-e29b-41d4-a716-446655440000",
  "total_changes": 7,
  "scan_start_time": "2026-04-28T02:00:00+00:00",
  "scan_end_time": "2026-04-28T02:15:30+00:00",
  "initiated_by": "System",
  "initiated_by_email": null,
  "counts_by_group": {
    "issues_detected": 2,
    "issues_resolved": 1,
    "records_added": 3,
    "records_changed": 1
  },
  "changes": [
    {
      "change_type": "issue_detected",
      "entity_type": "record",
      "entity_name": "staging.example.com",
      "zone_name": "example.com",
      "record_type": "A",
      "hostname": "staging",
      "ttl": 300,
      "value": "203.0.113.50",
      "field_changes": []
    },
    {
      "change_type": "record_changed",
      "entity_type": "record",
      "entity_name": "www.example.com",
      "zone_name": "example.com",
      "record_type": "A",
      "hostname": "www",
      "ttl": 300,
      "value": "198.51.100.10",
      "field_changes": [
        {
          "field_name": "value",
          "old_value": "198.51.100.5",
          "new_value": "198.51.100.10"
        },
        {
          "field_name": "ttl",
          "old_value": "3600",
          "new_value": "300"
        }
      ]
    },
    {
      "change_type": "record_detected",
      "entity_type": "record",
      "entity_name": "api.example.com",
      "zone_name": "example.com",
      "record_type": "CNAME",
      "hostname": "api",
      "ttl": 300,
      "value": "lb.example.com",
      "field_changes": []
    }
  ],
  "changelog_url": "https://app.dnswatchdog.io/audit/changes?scan_id=550e8400-e29b-41d4-a716-446655440000"
}

Top-level fields

Change object fields

Each entry in the changes array has the following structure:

Change types

Field change object

For record_changed events, the field_changes array contains before/after diffs:

Scanner metadata fields (port scan results, ISP data, HTTP status, etc.) are excluded from field-level diffs — only user-visible DNS record fields are included.

Managing channels

Enabling and disabling

You can enable or disable a channel without deleting it. Disabled channels skip delivery but retain their configuration.

Deleting a channel

Deleting a channel removes it permanently. The webhook URL or email address is also removed from secure storage.

Admin access required

Creating, updating, and deleting notification channels requires admin permissions within your organisation.