A dated trail, not a snapshot
Most tools show DNS as it is right now. DNSTimeMachine shows the observed sequence: the earlier answer, the replacement, and the date that replacement was first seen.
DNS change history
Find the DNS change that lines up with the incident.
When something breaks, the first question is what changed. A live DNS lookup gives no answer because the old value is gone. DNSTimeMachine shows a dated trail of observed record changes, so you can compare the outage timeline with the first date a new answer appeared.
Enter the domain where mail, routing, a certificate, or verification broke.
Publicly observed DNS history, not a complete zone backup.
For SREs, sysadmins, and support engineers asking whether a DNS change lines up with the start of an incident.
How the history reads
The record, before and after.
Each captured answer is stored with its observation date, so you can compare the earlier value with the change that replaced it.
Tie a break to a change
Line up the date an incident started against the first-seen date of a DNS change. A match gives you a concrete lead to verify against logs and telemetry.
The change nobody logged
A removed SPF include or a repointed CNAME is obvious in hindsight. The dated history makes it obvious in the incident review, not three postmortems later.
When you reach for this.
- An incident started and nobody admits to a change
- Email authentication broke without warning
- A certificate stopped validating overnight
- Traffic started landing on the wrong host
"What did this used to be?"
The question a live lookup cannot answer. Enter the domain above and we will send its history the moment access opens.
Look up a domainDirect answers
Questions about dns change history.
How do I check when a DNS record changed?
Compare the earlier observed value with the replacement and its first-seen date. This narrows the incident window, although observation time may not equal the precise edit time.
Does a matching DNS change prove the cause of an outage?
No. A matching date is a strong lead to investigate alongside deploys, provider logs, TTLs, and application telemetry, not proof of causation by itself.
Which changes are useful during incident response?
A and CNAME changes can affect routing, MX and TXT changes can affect mail, NS changes can indicate provider moves, and verification records can affect certificates or third-party services.