Hourly

Get a Slack alert when a DNS record changes

Within the hour you know about any DNS record that was added, removed or edited, and what it looked like before.

Runs: Hourly
Apps: Cloudflare
AI: Not needed
Access: DNS: Read

Send this to your assistant

Create a ClickRuntime automation: every hour, check the DNS records in my Cloudflare zones and post to #ops in Slack any record that was added, deleted or edited since the last check, with the old and new values.

Paste it into your assistant. It tells you what it will send or change before it runs live.

Add to ChatGPT Add to Claude

First time? Adding ClickRuntime to your assistant takes about two minutes.

Why use it

Why teams use this automation

A DNS change is quiet and dangerous. An administrator edits a record to test something and forgets to revert it, a vendor is given access and changes a CNAME, or an attacker with stolen credentials points a subdomain somewhere else. Cloudflare's audit log can show it, but only if someone knows to look.

Every hour, this lists your DNS records, compares them with the snapshot saved on the previous run, and posts a message showing exactly which records were added, removed or edited. It then saves the new state as the baseline for the next check.

Security-minded teams and agencies who share Cloudflare access among several people use it as a tripwire. The comparison uses a snapshot saved on the previous run, so the message shows what is different now, not a full list of every record to read through.

What you get out of it

Detect hijacked or tampered records
A subdomain suddenly pointing at an unfamiliar IP is how takeovers start. An hourly diff limits the exposure window to minutes rather than however long it takes someone to spot it. An unfamiliar IP on a subdomain is how takeovers begin, and an hourly diff keeps the window of exposure down to minutes.
Catch honest mistakes quickly
Most changes are accidental, such as a wrong value pasted in. Seeing the diff within the hour lets the person fix it before email bounces or a site goes down. Most DNS mistakes are honest ones, such as a pasted value that is slightly wrong, and a quick fix avoids bounced mail and downtime.
Know who to ask about a change
The post shows what changed and when, giving you something specific to bring to a teammate. That ends the mystery of an edit that nobody admits to. A dated message showing exactly which record changed gives you something specific to ask a teammate, and ends the mystery of an unexplained edit.
Create evidence for compliance
A running log of every record change supports change-management reviews. You can show when a record changed and that it was noticed promptly. A running log of record changes supports change-management reviews, and shows that changes were noticed soon after they were made.
Reduce the damage of shared access
When several people or vendors have Cloudflare access, a diff alert is cheap oversight. It does not block anyone, but it does make changes visible to everyone. With several people or vendors holding access, a diff alert makes changes visible to everyone and does not get in anyone's way.

How it works

What happens, step by step

Every hour ClickRuntime reads all the DNS records in your Cloudflare domains.
It compares them with the copy it saved last hour.
Any record that was added, removed or edited goes to your Slack channel, showing the old and new values.
The new copy is saved for the next check.

Before it runs live

Connect Cloudflare

What you get

RunsHourly

Get a Slack alert when a DNS record changestoday, 9:00Succeeded

Slack · #opsEdited: A shop.example.com -> 192.0.2.10 => A shop.example.com -> 198.51.100.7

Build your own

Need it to work differently?

This template is a starting point. Copy the prompt and change it, or describe a different automation from scratch, with your own conditions, more apps or an AI step. Your assistant writes it, tests it and runs it on ClickRuntime.

Your own rules
Conditions, thresholds, filters and exceptions, written the way you'd explain them to a colleague.
Any number of apps
One automation can read from one app and update several others. Over 248 apps are ready, and anything with an API works too.
AI where it helps
Summaries, classification, extraction and drafts use ClickRuntime's built-in AI, with no extra key.
On a schedule or on each event
Runs as often as every 5 minutes, or the moment an app sends an event, and keeps track of what it already handled.

Changes you can ask for

Run it at a different time, more or less often, or only on weekdays
Add an AI step, for example to summarize, sort or draft a reply
Add another app, for example also send it to Slack
Combine it with other Cloudflare steps into one automation

Under the hood

The code that runs this automation

This is the Python script that runs each time the automation starts. Your AI assistant writes it for you when you send the prompt, and you allow each step in your assistant. To change how the automation works, describe the change to your assistant and it updates the script for you. For every function it can use, see the script reference.

get_alerted_when_dns_records_change.pyexample

from clickruntime import on_trigger, credentials, http, notify, state

CF = "https://api.cloudflare.com/client/v4"

def cf(path, **params):
    resp = http.get(f"{CF}{path}", params=params, headers={"Authorization": f"Bearer {credentials.secret('CLOUDFLARE_API_TOKEN')}"})
    resp.raise_for_status()
    return resp.json()["result"]

@on_trigger
def run(event):
    snapshot = {}
    for zone in cf("/zones", per_page=50):
        for r in cf(f"/zones/{zone['id']}/dns_records", per_page=5000):
            snapshot[r["id"]] = f"{r['type']} {r['name']} -> {r['content']}"
    old = state.get("records")
    changes = []
    if old is not None:
        changes += [f"Added: {v}" for k, v in snapshot.items() if k not in old]
        changes += [f"Deleted: {v}" for k, v in old.items() if k not in snapshot]
        changes += [f"Edited: {old[k]}  =>  {v}" for k, v in snapshot.items() if k in old and old[k] != v]
    if changes:
        notify.slack("DNS changes\n" + "\n".join(changes), channel="#ops")
    state.set("records", snapshot)
    return {"changes": len(changes)}

FAQ

Common questions

What does the diff message show?

It lists records that were added, removed or changed since the last snapshot, with their type, name and value. That gives enough detail to judge whether the change was intended. The post lists the type, name and value of each record that was added, removed or changed since the last snapshot was saved.

Will it alert on the first run?

The first run has no earlier snapshot, so it simply stores the current records as the baseline. Alerts begin from the second hour onward, when something differs from that stored state. The first hourly run just saves the baseline, so alerts start once a later run finds something different from that stored state.

Can it watch only certain record types?

Yes. If MX and TXT records matter most, the comparison can be limited to those types. Describe it to your AI assistant and approve the updated check before it replaces what runs today. You can restrict the check to MX and TXT records if those matter most.

What permissions does it need?

DNS: Read. Nothing else in your accounts is used.

Does it need AI?

No. It runs without AI, so it doesn't use your plan's AI allowance.

How many runs does it use?

One run each time it runs (hourly). Checks that find nothing to do and stop right away aren't counted.

Can I change how it works?

Yes. Describe the change to your AI assistant, for example a different schedule, channel or filter. It updates the automation, tests it and tells you what changed.

On a schedule