DNSWatch

Overview

Track A, AAAA, CNAME, MX, NS, TXT, SPF, DMARC, and CAA changes.

DNSWatch is part of the X3roxDev Security & DevSecOps Toolkit. It is designed as a defensive, read-only-first open-source project for systems you own or are authorized to test.

Demo

DNSWatch demo output is available in examples/example-output.txt.

Features

• DNS snapshots
• Baseline comparison
• Historical JSON storage
• HTML reports
• Webhook notifications

Architecture

The project separates configuration, collection, analysis, reporting, and notifications. Scanners return structured findings with severity, evidence, and remediation text, while output adapters render terminal, JSON, CSV, HTML, or SARIF formats where relevant.

Installation

Clone the repository and install the stack-specific dependencies shown below.

git clone https://github.com/x3roxdev/dnswatch.git
cd dnswatch

Quick Start

go run ./cmd/dnswatch --help

Configuration

Copy .env.example when environment values are needed. Runtime settings can be supplied with --config config.example.yaml where the CLI supports it. Defaults are conservative and avoid destructive remediation.

Commands

• dnswatch add example.com
• dnswatch baseline
• dnswatch check
• dnswatch watch
• dnswatch history

Example Output

DNSWatch

Overall Score: 84/100

HIGH    1
MEDIUM  2
LOW     3
PASS    8

Top Finding:
Severity: HIGH
Evidence: Example defensive finding generated from local checks.
Recommendation: Review the documented hardening guidance before making changes.

Export Formats

Supported formats are documented per command. Most scanners support terminal and JSON output; report-oriented tools also include CSV, HTML, or SARIF exports.

Testing

Run the language-specific test command from the repository root. CI runs the same checks on pull requests.

Docker

Where included, Docker files run the service with non-secret configuration from environment variables. Never bake tokens into images.

Security Considerations

This is a defensive tool. It does not include destructive exploitation features, does not log secrets, and masks sensitive findings where applicable. Only run scans against systems and repositories you own or are authorized to assess.