> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cantina.security/llms.txt
> Use this file to discover all available pages before exploring further.

# DNS Monitor

> Built-in DNS monitoring — watch your zones for record, subdomain, and email-authentication changes with no external service.

The DNS Monitor is built into Clarion. There is no vendor to connect and no credential to store: you name the domains to watch, and Clarion resolves them on a schedule, comparing each result against the last.

<Note>
  **Estimated time:** 2 minutes. You need only the domains you want monitored.
</Note>

## Connect

1. In Clarion, open **Integrations** and find **DNS Monitor**.
2. Click **Connect** — the integration activates immediately.
3. Add a monitor per domain you want watched.

## What it detects

Each check compares the current answer against the previous one and raises an issue on a meaningful difference:

* **Record changes** — A, AAAA, CNAME, MX, NS, and TXT records that changed unexpectedly
* **Email-authentication changes** — SPF, DKIM, and DMARC records, the ones that gate whether someone can spoof your domain
* **New subdomains** — names that appeared since the last scan
* **Nameserver and registrar changes** — the signature of a domain hijack
* **Certificate and TLS posture** on the resolved hosts

These feed the [DNS & Domain Security](/clarion/learn/agents#our-agents) agent, which carries seven skills covering record change, subdomain change, email-auth change, new subdomain discovery, registrar compromise, DNS tunneling, and DDoS amplification.

## What agents can do

The DNS tools are available to every agent, whether or not the monitor is watching a given name:

| Tool | What it returns |
| - | - |
| `dns_lookup` | Resolve a name across record types |
| `dns_dig` | A raw `dig`-style query for a specific record type |
| `dns_compare` | Compare a name's answers across resolvers |
| `whois_lookup` | Registrar and registration data for a domain |
| `spf_check` / `dkim_check` / `dmarc_check` | Email-authentication posture for a domain |
| `tls_check` | Certificate chain, expiry, and TLS configuration for a host |

## Acting on findings

The DNS Monitor detects; it does not change records. To let an agent *fix* a DNS problem, connect [Cloudflare](/clarion/integrations/cloudflare) — that integration carries the record write and zone rollback tools, and the [Dangling Subdomain Agent](/clarion/learn/agents#our-agents) uses it for its daily sweep.

## Disconnect

Click **Disconnect** on the integration page. Monitors under it stop running.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.