DNS management & change control for MSPs
Stop juggling 26 provider portals. DNSMentor puts every zone you manage behind one pane of glass, runs 56 checks before anything goes live, and teaches the engineer who made the change.
No card. No sales call to unlock it. The demo needs no sign-up at all.
Manage DNS across
Proposed change
acme-engineering.co.ukChecks
0 errors your DNS provider would have shown you for the same change. It would have said Saved.
What is DNSMentor?
DNSMentor is a DNS change management platform for managed service providers. It connects 26 DNS providers into a single pane of glass, runs 56 automated checks before any change is applied, routes changes for approval, verifies the result in public DNS, and trains the engineers making the changes. It is built for MSPs managing DNS on behalf of many client businesses.
What DNSMentor is
Your clients came with the providers they came with. Connect 26 of them with an API key each and every zone, every record and every problem lands in one place — searchable, filterable, and grouped by the client who pays for it.
Firewall changes get a change board. Server patching gets a window. DNS gets done at nine at night with no second pair of eyes. DNSMentor puts 56 automated checks, an approval step and independent verification between your engineer and live DNS.
Nobody learns DNS on a course. They learn it the day they break something. So 15 modules and a 19-article reference sit inside the tool, and every rejected change becomes the explanation of why.
Five ways to take a client off the air without seeing an error
A firewall rule that is wrong drops packets you can watch. A failed backup sends an email. A server that will not boot pages somebody. DNS accepts the change, returns success, and waits.
TXT @ "v=spf1 include:_spf.thenewcrm.com ~all" spf-single-record A domain must publish at most one SPF record.
MX @ 10 acme-co-uk.mail.protection.outlook.com mx-requires-manual-verification Every MX value gets a human check. The brief mandates this and it is not configurable off.
CNAME @ northgate.pages.dev cname-not-at-apex A CNAME cannot sit at the zone apex, because the apex must carry SOA and NS records.
TXT selector1._domainkey "v=DKIM1; k=rsa; p=MIIBIjANBg…" dkim-record-format Checks DKIM records are published at a selector name and look like a key.
A @ 198.51.100.24 ttl 86400 lower-ttl-before-migration Reminds engineers to lower TTLs ahead of a migration rather than at the moment of cutover.
How a change moves
Most of them exist because somebody, somewhere, skipped one at nine o’clock at night. Click along the rail.
DNSMentor reads every zone the account holds and every record in them. No agent, no zone transfer, no CSV. The credential is stored encrypted and stripped out of anything that gets logged or exported.
Templates cover the jobs you do weekly — Microsoft 365 in one action rather than nine. Where AI proposes records it shows its reasoning and its sources, and a person still has to look at it and press the button.
Not against the change in isolation — against the zone the change would produce. That is how a second SPF record gets caught: the record you typed is perfectly valid, and it is the one already there that makes it fatal. 27 rules block outright. The rest have to be read and accepted by name.
A diff of what the zone looks like now against what it would look like after — including the records you did not touch that stop resolving because of the ones you did.
Configurable per organisation and per engineer. A senior who has demonstrated the skill applies unsupervised. Somebody in their first week does not. The same platform, adapting to who is using it, rather than one setting for everybody.
The zone is read again immediately before the write, so a change somebody else made in the portal while this one sat in approval is not silently clobbered. If the provider rejects it, you get the provider’s own words, not a generic failure.
“The provider accepted it” and “the world can see it” are two different claims, and DNSMentor never merges them. Applied is one status. Live is another. Plenty of outages live in the gap between the two.
What changed, why, what was checked, who approved it and whether it is live — written out of the audit record rather than from memory at the end of the day. Paste it into the ticket.
The audit trail
Every entry is sealed against the one before it. Edit any field below and verify the chain — it will tell you exactly which entry was touched, and everything after it stops being trustworthy too. This is the same construction the product uses, running here in your browser.
Tip: try changing rejected to approved on entry 3, or putting a different name on entry 4.
The half nobody else has
Any tool can stop a bad change. Stopping the same bad change every week is not a product, it is a tax. So the platform knows what each engineer has actually demonstrated, gates what they can apply unsupervised, and turns every rejection into the explanation of why.
Nobody gets sent on a course. The teaching happens at the moment of the mistake, which is the only moment anybody is paying attention.
See the curriculum →
Levels are earned in the product and set per organisation. Nobody, at any level, can
switch off mx-requires-manual-verification.
Pricing
Charging by domain punishes you for winning the client that made the tool worth having. What this platform manages is the number of people who can take a client offline, so that is what it counts.
The things an MSP owner wants settled before booking anything.
DNSMentor is a DNS management and change control platform built specifically for managed service providers. It connects 26 DNS providers — including Cloudflare, AWS Route 53, Azure DNS, Google Cloud DNS, GoDaddy and Namecheap — into a single pane of glass, runs 56 automated checks before any change is applied, requires a second pair of eyes where policy demands it, verifies the result in public DNS, and trains the engineers making the changes.
Yes. DNSMentor connects to 26 DNS providers through their own APIs and presents every zone and record from all of them in one interface. You add an API credential per provider once, DNSMentor imports every zone that account holds, and your engineers then work in one place instead of six provider portals with six separate logins.
DNSMentor runs 56 automated checks against the zone as it would exist after the change, not just against the record being typed. 27 of those checks block the change outright and cannot be overridden at any skill level. The remainder must be read and accepted by name. Changes can then require approval from a second engineer, and approval rules are configurable per engineer as well as per organisation.
Because DNS returns an error only when a record is malformed, never when it is merely wrong. A mistyped MX target is perfectly valid DNS, so mail queues at the sending server and retries for up to five days before anybody sees a bounce. A second SPF record is valid too, and silently removes SPF protection entirely. The provider console reports success in both cases.
Yes. Every action is written to a hash-chained, tamper-evident audit trail: each entry is sealed against the one before it, so editing or removing any record breaks the chain and verification reports exactly where. The trail is exportable per client and is built for ISO 27001, Cyber Essentials and customer security reviews.
Minutes rather than a project. You paste an API credential for one DNS provider, DNSMentor discovers every zone in that account and imports the records, and the estate is on screen. There is no agent to deploy, no zone transfer to configure, and no change to where your DNS is hosted.
Yes. DNSMentor offers a 7-day free trial with full Team features and no card required. You connect a provider, import a real estate and run real changes through the checks. Nothing is ever applied without somebody pressing apply.
Thirty minutes, your estate, your worst zone. If the checks find nothing you did not already know, we have wasted half an hour of your time and none of your money.
No card. No trial clock. UK-hosted, and we will tell you which providers we have actually proven before you ask.