> ## Documentation Index
> Fetch the complete documentation index at: https://docs.clarion.cantina.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# DNS Monitor

> Built-in DNS monitoring — watch your zones for record, subdomain, and email-authentication changes with no external service.

The DNS Monitor is built into Clarion. There is no vendor to connect and no credential to store: you name the domains to watch, and Clarion resolves them on a schedule, comparing each result against the last.

<Note>
  **Estimated time:** 2 minutes. You need only the domains you want monitored.
</Note>

## Connect

1. In Clarion, open **Integrations** and find **DNS Monitor**.
2. Click **Connect** — the integration activates immediately.
3. Add a monitor per domain you want watched.

## What it detects

Each check compares the current answer against the previous one and raises an issue on a meaningful difference:

* **Record changes** — A, AAAA, CNAME, MX, NS, and TXT records that changed unexpectedly
* **Email-authentication changes** — SPF, DKIM, and DMARC records, the ones that gate whether someone can spoof your domain
* **New subdomains** — names that appeared since the last scan
* **Nameserver and registrar changes** — the signature of a domain hijack
* **Certificate and TLS posture** on the resolved hosts

These feed the [DNS & Domain Security](/learn/agents/our-agents) agent, which carries seven skills covering record change, subdomain change, email-auth change, new subdomain discovery, registrar compromise, DNS tunneling, and DDoS amplification.

## What agents can do

The DNS tools are available to every agent, whether or not the monitor is watching a given name:

| Tool                                       | What it returns                                             |
| ------------------------------------------ | ----------------------------------------------------------- |
| `dns_lookup`                               | Resolve a name across record types                          |
| `dns_dig`                                  | A raw `dig`-style query for a specific record type          |
| `dns_compare`                              | Compare a name's answers across resolvers                   |
| `whois_lookup`                             | Registrar and registration data for a domain                |
| `spf_check` / `dkim_check` / `dmarc_check` | Email-authentication posture for a domain                   |
| `tls_check`                                | Certificate chain, expiry, and TLS configuration for a host |

## Acting on findings

The DNS Monitor detects; it does not change records. To let an agent *fix* a DNS problem, connect [Cloudflare](/integrations/cloudflare) — that integration carries the record write and zone rollback tools, and the [Dangling Subdomain Agent](/learn/agents/our-agents) uses it for its daily sweep.

## Disconnect

Click **Disconnect** on the integration page. Monitors under it stop running.