Domains, DNS and mail

DNS monitoring with manipulation detection, Certificate Transparency, and mail server checks.

Domains

DNS → Domains lists the zones you monitor and the domains discovered from hostnames (registered domain by the Public Suffix List). Add domain asks explicitly whether DNS and/or the mail servers are monitored, each with its own parameters. The first check runs at once on the chosen satellites, and the domain page then offers to create a schedule with exactly the parameters of that first check (one plan per check).

New domains must be delegated by their registry (POLARIS_VERIFY_DOMAINS).

What the DNS check does

The dns check runs on the satellite and uses the satellite host’s resolver — what systems at that place really get — unless the plan sets public or own resolvers. Every answer is compared with the authoritative name servers, found via the parent zone’s delegation and asked directly over UDP and TCP.

• Records: every record of the zone apex and the watched names; added and removed records are kept as history (dns.changed; mail-related ones flagged and sent as dns.mail_changed).
• Name servers: serial, authoritative answer, response time per server.
• Manipulation: answers that differ from the authoritative ones are reported per satellite — different, suppressed (missing locally) or only local — with the resolver that gave them (Pulsar asks each configured resolver separately). Split horizon, interception and hijacking show up here, together with blocked or intercepted UDP/53.
• SPF, DMARC, DKIM, DNSSEC, CAA are evaluated from the authoritative data when the local view hides them.

Every result gets a rating 1–5 that rises with each further satellite confirming the same answer, and the domain gets a grade A–F (DNS and mail score, every criterion listed; an open relay caps it at F).

Subdomains

A name inside a zone (e.g. c.example.at in example.at) is not checked as a zone: name servers, SOA and DNSSEC come from the zone, CAA by climbing the tree, DMARC from the zone’s sp=, DKIM keys published at the zone. Records answered by the zone’s wildcard are marked. SPF is not inherited and only noted.

Watched names

Discovered names (from DNS, PTR, certificates, CT) can be watched: their records are then tracked by the domain’s DNS check like the apex (up to 50 per domain).

Certificate Transparency

Polaris checks every monitored domain on crt.sh once per POLARIS_CT_REFRESH_HOURS (6). Only Polaris asks crt.sh; satellites get the names from Polaris and resolve them.

• The first poll is the baseline; afterwards new certificates raise ct.new, and a certificate from a CA not seen before for the domain opens a finding.
• crt.sh is a free service that often answers 502 under load. Polaris runs every 10 minutes and takes only its share of the domains, so every domain is checked once per period, spread evenly. Requests are paused POLARIS_CT_PAUSE_SECONDS (10) apart, a failed domain is retried with backoff, and a failure ends the round.
• Wildcard-only common names (*.example.com) are not names to check and are dropped.

Mail

The mail check (Mail monitoring) takes every MX of a domain and checks:

• PTR of each address and whether it resolves back,
• banner and EHLO name against PTR and MX name,
• STARTTLS, TLS version and the certificate against MX and PTR name,
• optionally an open relay test: MAIL FROM / RCPT TO to a foreign domain and RSET — never DATA, nothing is sent. Answers are open, closed or inconclusive. Set a real foreign test recipient: strict servers refuse RFC 2606 example domains before they decide about relaying.

SPF, DMARC and DKIM are read by the mail check itself, so Mail monitoring works without DNS monitoring.