WebCheck DNS checks resolve the target hostname and record normalized A, AAAA, CNAME, MX and NS records. The first successful result establishes a reference; a later meaningful record change is reported for review.
Records WebCheck records
The DNS inspector normalizes and sorts supported records before calculating a record hash. This helps avoid reporting a change just because records were returned in a different order. TTL values are not included in the DNS evidence.
Cloudflare proxy handling
When every resolved A/AAAA address matches Cloudflare's published proxy ranges, WebCheck treats A/AAAA answers—and the origin CNAME hidden by proxying—as Cloudflare delivery details, not as customer DNS changes. This recognizes both the initial origin-to-proxy transition and normal Cloudflare edge-address rotation without requiring a user to accept a new baseline. WebCheck still compares stable records such as MX and NS, and retains the raw DNS answers as run evidence. Mixed or unrecognized address sets use normal exact comparison.
This exception applies only to DNS record comparison. DNS resolution and private-address safety checks still run, and HTTP/TLS checks continue to test the monitored hostname separately.
First run and later runs
The first successful DNS result establishes the reference. A later difference is recorded as a DNS-records-changed failure. Review the records in the run evidence and compare them with the DNS provider's current configuration and change history.
WebCheck does not currently offer a dashboard control to accept a new DNS baseline. If a planned DNS migration causes a reported change, keep the related change record and check results together while you investigate.
What to do after a change
Check the DNS provider change history and recent hosting or CDN work. Compare the records WebCheck reported with the provider's current configuration and allow for resolver caching when interpreting a recent change.
Important limitation
One monitoring environment cannot represent every resolver everywhere. DNS propagation and caching can make results differ temporarily from a lookup on your own computer. WebCheck's DNS check also does not replace a full DNS security or email-configuration audit.