DNS Monitor

Complete guide to VistoShield DNS Monitor — DNS health checks, change detection, SSL monitoring, email security validation, and configuration.

Overview

DNS Monitor continuously audits your domain’s DNS configuration and SSL certificates to catch misconfigurations, unauthorized changes, and expiring certificates before they cause downtime or security incidents.

The plugin performs 9 categories of DNS checks, monitors your SSL certificate expiry, and detects any changes to your DNS records over time. Everything is implemented in pure PHP using native functions like dns_get_record(), checkdnsrr(), and stream_socket_client() — no exec() or shell commands are required, so it works on shared hosting with restricted environments.

Why DNS health matters:

• Email deliverability — Missing or misconfigured SPF, DKIM, or DMARC records cause emails to land in spam or get rejected entirely.
• Security — Unauthorized DNS changes can redirect your traffic to attacker-controlled servers.
• Availability — Expired SSL certificates, missing nameservers, or incorrect A records cause immediate downtime.
• Trust — DNSSEC, CAA, and proper HSTS configuration build trust with browsers and visitors.

Installation & Setup

1. Install the plugin — Install from the WordPress plugin directory by searching for “VistoShield DNS Monitor”, or upload the ZIP file via Plugins → Add New → Upload Plugin.
2. Activate — Activate the plugin from the Plugins screen. The database tables are created automatically on activation.
3. Navigate to the dashboard — Go to VistoShield → DNS Monitor in the WordPress admin menu.
4. Run your first check — Click the “Run Check Now” button. The plugin will perform all 9 DNS checks and the SSL certificate check, then display your DNS Health Score.
5. Configure DKIM selector — If you use a custom DKIM selector (anything other than default), go to Settings and enter your selector name so the DKIM check queries the correct record.

Dashboard

The dashboard provides a real-time overview of your domain’s DNS health:

DNS Health Score

The score is a weighted value from 0 to 100 based on the results of all 9 DNS check categories. Each category contributes a percentage of the total score based on its importance (see Scoring System below). A passing check earns 100% of its weight, a warning earns 50%, and a failure earns 0%.

Stats Cards

Check Results

Each of the 9 categories displays a status indicator:

• Pass (green) — The check passed all validations.
• Warning (orange) — The configuration works but has room for improvement.
• Fail (red) — A critical misconfiguration was found that needs attention.
• N/A (grey) — The check could not be performed (e.g., DNS record type blocked by the host).

Recent Changes Feed

Below the check results, a chronological feed shows recent DNS record changes with old and new values, making it easy to spot unauthorized modifications.

DNS Checks Explained

DNS Monitor performs 9 categories of checks. Each is described below with what is checked and what each status means.

1. Nameservers (NS)

Verifies that your domain has at least 2 nameservers and that they resolve correctly.

2. SOA (Start of Authority)

Checks the SOA record for RFC 1912 recommended values including serial format, refresh, retry, expire, and minimum TTL.

3. MX (Mail Exchange)

Verifies that MX records exist and that the mail servers resolve, ensuring email delivery works.

4. SPF (Sender Policy Framework)

Validates the SPF TXT record, checking for common issues like exceeding the 10-lookup limit or using the dangerous +all mechanism.

5. DKIM (DomainKeys Identified Mail)

Checks for a DKIM public key record at <selector>._domainkey.yourdomain.com. The default selector is default, but this can be configured in Settings.

6. DMARC (Domain-based Message Authentication)

Checks for a DMARC record at _dmarc.yourdomain.com and evaluates the policy level.

7. DNSSEC

Verifies that DNSSEC is enabled by querying for a signed response. DNS Monitor uses Google’s DNS-over-HTTPS API (dns.google/resolve) to check the Authenticated Data (AD) flag, which indicates a valid chain of trust from the root zone to your domain.

8. CAA (Certificate Authority Authorization)

Checks for CAA records that restrict which Certificate Authorities can issue certificates for your domain. This prevents unauthorized certificate issuance.

9. Web Records (A/AAAA)

Verifies that A and/or AAAA records exist for the domain and checks TTL values.

SSL Certificate Monitoring

DNS Monitor connects to your domain over TLS and inspects the certificate to detect issues before they cause browser warnings or downtime.

What It Checks

• Issuer — The Certificate Authority that issued the certificate
• Expiry date — Days remaining until expiration
• Subject Alternative Names (SANs) — Verifies your domain is listed in the certificate
• Protocol version — Confirms TLS 1.2 or higher is supported

Alert Thresholds

How It Works

SSL checks use PHP’s stream_socket_client() with an SSL context to connect to port 443 and extract certificate metadata. No exec() or openssl CLI calls are used, so it works on shared hosting with restricted PHP configurations.

Change Detection Pro

DNS Monitor Pro takes periodic snapshots of your DNS records and compares them against previous snapshots to detect changes.

How Snapshots Work

After each check, the plugin serializes the current DNS state (all record types and values) and stores it in the database. On the next check, the new snapshot is compared against the previous one. Any differences are recorded as changes.

What Triggers Alerts

• A record added, removed, or modified
• AAAA record added, removed, or modified
• MX record priority or target changed
• NS record added or removed
• TXT record content changed (SPF, DKIM, DMARC, verification records)
• SOA serial or timing values changed

Change History View

The Changes tab displays a filterable log of all detected changes with timestamps, old values, new values, and the record type affected. This provides an audit trail for DNS modifications.

Settings Reference

Scoring System

The DNS Health Score is calculated as a weighted sum of all 9 check categories:

How Status Maps to Score

Technical Details

Pure PHP Implementation

DNS Monitor is built entirely with native PHP functions and requires no shell access:

DNSSEC via DNS-over-HTTPS

Since PHP’s dns_get_record() cannot check DNSSEC validation, DNS Monitor queries Google’s public DNS-over-HTTPS endpoint (https://dns.google/resolve?name=yourdomain.com&type=A) and checks the AD (Authenticated Data) flag in the response. This requires outbound HTTPS access to dns.google.

Shared Hosting Compatibility

Because no exec(), shell_exec(), or proc_open() calls are used, DNS Monitor works on virtually any WordPress hosting environment, including shared hosting with restricted PHP functions.

Database Tables

Free vs Pro

Troubleshooting / FAQ

Some checks show “N/A”

Your hosting provider may block certain DNS record type queries at the PHP level. This is common on some shared hosts that restrict dns_get_record() for specific record types (especially CAA and SOA). The affected categories are excluded from the score calculation so your health score is not penalized.

DNSSEC check fails or shows N/A

The DNSSEC check requires outbound HTTPS access to dns.google (port 443). If your server’s firewall blocks outbound HTTPS requests or if wp_remote_get() is disabled, this check cannot be performed. Verify that your server can reach https://dns.google/resolve.

SSL check shows wrong certificate

If your site is behind a CDN or reverse proxy (e.g., Cloudflare, Sucuri, or a load balancer), the SSL check may inspect the CDN’s certificate rather than your origin server’s certificate. This is expected behavior — the CDN certificate is what visitors actually see. If you need to monitor your origin certificate, check it directly from your hosting control panel.

DKIM check fails even though DKIM is configured

The most common cause is a mismatched selector name. The plugin queries <selector>._domainkey.yourdomain.com — if your email provider uses a different selector than the default (default), you need to update it in VistoShield → DNS Monitor → Settings. Check your email provider’s documentation for the correct selector name.