Community

banshee is under active development: collectors will keep changing, and a version you publish will likely need adjustments. For stable use, wait for version 1.0.0.

Network

banshee/network-collection/network/dns/

resolution

Whether a name resolves by a DNS server, what it answers and how fast, to see a name lost, a record changed or a slow server.

  • network
  • dns
  • resolution
  • name
  • record
  • latency

by banshee1 installation2 versions

v1

You are reading version 1, of October 27, 2026. The latest is version 2.

See version 2

Resolution of a name by DNS

Asks a DNS server for a name and a type of record, and returns whether the name resolves, what the server answers and how long it took. Three watches are offered: the name does not resolve, an unexpected answer, and a slow resolution.

How it works

One query, the name and the type set on the probe, sent to the server of protocol:dns:server, port 53; without that variable, to the resolver of the poller's system. The server is asked to resolve the name fully, as any resolver asks.

VariableSaysDefault
dns:namethe name to resolve, set on the probe; for PTR, an IP address— (required)
dns:typethe type of record: A, AAAA, CNAME, MX, TXT, NS, SOA or PTRA
protocol:dns:serverthe server asked: a DNS name or an IP address, set on the host or a folder, once on the root for the whole treethe resolver of the poller's system
protocol:dns:timeouthow long the answer is awaited, in seconds, 1 to 305
  • The name resolves when the server answers NOERROR with at least one record of the type asked. A name that does not exist (NXDOMAIN), a name without a record of this type, or a server that cannot resolve it (SERVFAIL) is an answer: "Name does not resolve" raises on it, and answer says the code of the server.
  • The answer is the records of the type asked, in the order the server gives them, joined by , : an address for A and AAAA, a name for CNAME, NS and PTR, the preference and the name for MX (10 mail.example), the text for TXT. A name is written in lower case, without its final dot.
  • A server that refuses the query, or does not answer in time, is down: the collector stops as critical, "DNS server down". Any other failure between the poller and the server stops it as unreachable.

The collector only reads: a DNS query asks the server for nothing but its answer.

Prerequisites

  • The server reachable from the poller on port 53, UDP and TCP, and willing to answer it: a resolver often answers only its own network.
  • dns:name set on the probe.

Outputs

NameLabelUnitPer instance
resolvedName resolves—no
answerAnswer—no
response-timeResponse timemsno

Watches

NameTitleKindDefaultsChecked by default
not-resolvedName does not resolvestate to avoid, on resolvedcritical on noyes
unexpected-answerUnexpected answerjudged by the collectorcritical when the answer set is not among those of the server; no answer by defaultno
slowSlow resolutionabove a threshold, on response-timewarning above 500 ms, critical above 2000 ms, for 3 runsyes

"Unexpected answer" compares the answer set with each answer of the server, in lower case: for a name behind several addresses, set one of them, and it raises when that one is no longer given.

Limits

  • A resolver answers from its cache: a record changed at the source is seen once its time to live is over. Ask the authoritative server of the domain, in protocol:dns:server, to see a change at once.
  • A TXT record long enough to be cut in several strings returns them joined, without a separator.