DNS Routing Drift Feed

Capture selected public DNS routing records and compare them with persistent snapshots. Feed structured changes into infrastructure inventories, scheduled audits and AI-agent workflows without visiting the target website, contacting its mail servers or modifying DNS. This is not an uptime, email-deliverability or security certification tool.

Input

{"domains":["example.com"],"recordTypes":["MX","NS","CAA"],"stateKey":"routing-watch"}

Use 1–10 ASCII domain names (punycode is accepted). Schemes, paths, ports, IP literals and common private/ special-use suffixes are rejected. Public domains only; no secret or internal names. Types are restricted to A, AAAA, MX, NS and CAA, at most five. Duplicate domains/types are checked once. Default is MX/NS/CAA.

Output

One Dataset row per complete domain check: domain, checkedAt, status (baseline/unchanged/changed), records by requested type and changes with before/after. First run is a baseline, not a change alert. Changing the recordTypes set creates an independent baseline. CNAME answers returned with selected types are retained. TTL, answer order, duplicate records, DNS diagnostic comments and unrelated record types are excluded from comparison. Hostname case/trailing dots and IP notation are normalized. Other presentation-only changes (such as alternative CAA quoting) may still appear as changes; no universal canonicalization is promised.

DNS NOERROR with no answers and NXDOMAIN (rcode=3) are valid billable observations. They are not mislabeled as HTTP/network errors. SERVFAIL/REFUSED, truncation, malformed responses, question mismatches, redirects and timeouts fail the run and preserve the previous snapshot. All requested types must complete before a domain is billable. Processing stops on the first source error; earlier successful domains remain billable. Up to 128 KB decoded response and 100 answer records per query, 20 seconds per domain, no automatic retry.

Only Google's public recursive DNS view is observed. Caching, geo-routing and propagation can produce differences; this is neither authoritative-zone enumeration nor multi-resolver consensus. NXDOMAIN is an observation, not proof that a registered domain is available. DNSSEC validation is left enabled at the resolver, but this Actor does not certify a domain's DNSSEC/security posture. No zone transfers or subdomain discovery.

Pricing

• domain-check: $0.003 per complete domain check (all selected types, including unchanged/empty/NXDOMAIN).
• apify-actor-start: $0.00005 per started GB, minimum one. Memory is fixed at 256 MB.
• No Dataset automatic event and no separate platform-usage surcharge. Post-run storage/export may have plan costs.

Set maximum charge in Console or API maxTotalChargeUsd. $0.00305 permits one domain plus start. Dataset is saved before charging; the snapshot advances only after confirmed charge. Processing stops at the spending limit. Failed queries have no domain-check charge but start still applies. A limit is per run, not per account. Storage, charge and snapshot update are not atomic. Interrupted runs may leave saved uncharged output or charged output without updated state. Resurrection/replay of an old run is rejected; a new run is billable.

State, scheduling and deletion

Do not run the same stateKey concurrently in one account. Serialize schedules and integrations; use separate keys for independent watches. No distributed lock or automatic schedule is installed. Start with daily checks. Named KVS dns-routing-<stateKey> retains normalized records until you delete it; each domain/types set uses one hashed key. Dataset retains diffs; default KVS retains INPUT/OUTPUT, replay marker and last charge. Unnamed storage follows your plan retention; named data does not automatically expire. Review retention at least every 30 days. Stop schedules and runs before deleting the named KVS, each related Dataset/default KVS, obsolete run logs and downstream exports. Next run establishes a baseline. Deleting one store does not remove other data copies. Authenticated DELETE /v2/key-value-stores/{id} and /v2/datasets/{id} can automate your policy. Keep storage access restricted; do not share tokens. Do not resurrect old runs after deleting replay markers.

Privacy and source policy

Domains and record types are sent to Google Public DNS via https://dns.google/resolve. The client supplies edns_client_subnet=0.0.0.0/0 to avoid forwarding a client subnet to authoritative servers. Google can still observe the request and platform IP; this is not anonymous or private DNS. Do not submit personal, confidential or internal names. Only DNS routing records are retained, not WHOIS contacts, TXT tokens, SPF/DMARC or email addresses. No data is sent to an LLM. Returned record targets are data only and are never fetched or connected to.

All outgoing HTTP requests use a fixed Google HTTPS endpoint, certificate validation, no redirects and no environment proxy. Input cannot select an API host. Login, CAPTCHA, access-control bypass, mail delivery, port scanning and changing DNS records are unsupported. Users must confirm rights and source terms and avoid abusive frequency. Public DNS is not a license to republish confidential information; we do not claim automated legal/robots compliance. Normal valid public-domain checks need no operator intervention.

Official Google DNS JSON API This is an independent tool, not affiliated with Google. No Google account, API key, paid plan or LLM is needed.

API / agents

Use the standard Apify run API with this input and retrieve the Dataset or OUTPUT via the output schema. The finite input and structured delta are suitable for Apify Actor MCP tools; a separate custom MCP server is not provided. Direct API execution is tested. A particular MCP client's workflow is not separately certified.

Development

Python 3.12 / Apify SDK 4.0.2. Entry point: python -m dns_drift. Offline tests are under third_actor/tests.