More DNS records monitored

This week the new DNS module has gone live. From now on, we also track SOA, SRV, CAA and CNAME records. You can easily see the results on the domain page or find them with this query:

index=dns

We already monitored your TXT records, but now there is better support for DMARC and DKIM records. Besides the recordtype (rrtype) there now is a rrsubtype for SPF, DMARC and DKIM. So, this query will show all your SPF records:

index=dns rrsubtype=DMARC

The DNS records are all parsed and all fields are stored separately. That means you can query them. Here are some examples:

index=dns rrtype=SOA refresh=14400

index=dns rrtype=SOA | table url serial expire refresh retry

index=dns rrsubtype=DKIM k=rsa

index=dns rrsubtype=DMARC pct=100

Of course all new fields are available in the API too. For more information on which fields are available see the datamodel in the documentation.