Monitoring Technitium DNS Server with Vigilmon

Technitium DNS Server is a powerful, self-hosted recursive and authoritative DNS server with a built-in web management interface. It handles DNS resolution for your entire network, serves authoritative zones for your domains, and provides a clean dashboard for zone management (C#/.NET, web UI on port 5380, DNS on port 53). When your Technitium instance goes down, DNS resolution fails for every device and service that depends on it — a silent killer that makes everything look broken without an obvious cause. Vigilmon monitors your DNS server's health, web dashboard availability, zone transfer integrity, and query throughput so you catch failures before your network does.

What You'll Set Up

• HTTP monitor for the Technitium web dashboard (port 5380)
• DNS resolution health check using a TCP port monitor
• API health check via the Technitium REST API
• Cron heartbeat for zone transfer monitoring
• Query rate alerting via log-based watchdog

Prerequisites

• Technitium DNS Server running (web UI port 5380, DNS port 53)
• API access configured (API token from the Technitium web UI)
• A free Vigilmon account

Step 1: Monitor the Technitium Web Dashboard

The Technitium web UI is your management interface and also a proxy for API health. If the dashboard is down, you can't manage zones, change forwarders, or view query logs.

1. Log in to vigilmon.online and click Add Monitor.
2. Set Type to HTTP / HTTPS.
3. URL: http://your-server-ip:5380 (or https://dns.yourdomain.com if you've configured TLS)
4. Set Expected HTTP status to 200.
5. Set Check interval to 1 minute.
6. Optionally enable Keyword match and enter Technitium — the web UI includes this in the HTML, confirming the real dashboard loaded.
7. Click Save.

For production, place the Technitium web UI behind a reverse proxy with HTTPS:

server {
    listen 443 ssl;
    server_name dns-admin.yourdomain.com;

    location / {
        proxy_pass http://localhost:5380;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

Step 2: DNS Resolution Health via TCP Port Monitor

DNS listens on port 53 for both UDP and TCP. A TCP port check on port 53 verifies the DNS service is bound and accepting connections — a fundamental liveness signal that doesn't require decoding DNS protocol responses.

1. Click Add Monitor → TCP Port.
2. Set Host to your Technitium server hostname or IP.
3. Set Port to 53.
4. Set Check interval to 1 minute.
5. Click Save.

For a deeper DNS resolution check, use a scripted heartbeat that performs an actual DNS lookup:

#!/bin/bash
# /opt/technitium/dns-check.sh
HEARTBEAT_URL="https://vigilmon.online/heartbeat/YOUR_DNS_HEARTBEAT_ID"
DNS_SERVER="your-server-ip"
TEST_DOMAIN="google.com"

# Attempt a DNS resolution
RESULT=$(dig @"$DNS_SERVER" "$TEST_DOMAIN" A +short +time=3 +tries=1 2>&1)

if echo "$RESULT" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$'; then
    # Got a valid IP — DNS is resolving
    curl -s "$HEARTBEAT_URL" > /dev/null
else
    echo "DNS check failed: $RESULT"
    # No ping — Vigilmon alerts on missed heartbeat
fi

Run via cron every 2 minutes:

# crontab -e
*/2 * * * * /bin/bash /opt/technitium/dns-check.sh

Create a Push / Heartbeat monitor in Vigilmon with a 5 minute expected interval.

Step 3: Technitium REST API Health Check

Technitium exposes a REST API that provides server status, zone information, and query statistics. Use it for a richer health signal than a plain HTTP check.

First, generate an API token in the Technitium web UI:

1. Navigate to Settings → API in the Technitium dashboard.
2. Create a new API token with read-only permissions.
3. Copy the token.

Then create a dedicated API monitor in Vigilmon:

1. Click Add Monitor → HTTP / HTTPS.
2. URL: http://your-server-ip:5380/api/user/getInfo?token=YOUR_API_TOKEN
3. Set Expected HTTP status to 200.
4. Enable Keyword match and enter "status":"ok" — the Technitium API wraps all responses in a status envelope.
5. Set Check interval to 2 minutes.
6. Click Save.

For a more comprehensive health check, query the server statistics endpoint:

# Manual health check
curl -s "http://localhost:5380/api/server/getStats?token=YOUR_API_TOKEN" | \
  python3 -c "import sys, json; d=json.load(sys.stdin); print(d['response']['stats']['totalQueries'])"

If you prefer not to embed the token in a Vigilmon URL, create a thin health proxy endpoint on your server:

#!/usr/bin/env python3
# /opt/technitium/health-proxy.py — run with: python3 -m http.server 8053
from http.server import HTTPServer, BaseHTTPRequestHandler
import urllib.request, json, os

TOKEN = os.environ['TECHNITIUM_API_TOKEN']

class Handler(BaseHTTPRequestHandler):
    def do_GET(self):
        if self.path == '/health':
            try:
                resp = urllib.request.urlopen(
                    f'http://localhost:5380/api/user/getInfo?token={TOKEN}',
                    timeout=5
                )
                data = json.loads(resp.read())
                if data.get('status') == 'ok':
                    self.send_response(200)
                    self.end_headers()
                    self.wfile.write(b'ok')
                    return
            except Exception:
                pass
            self.send_response(503)
            self.end_headers()

HTTPServer(('localhost', 8053), Handler).serve_forever()

Monitor http://your-server-ip:8053/health instead of the raw API URL.

Step 4: Zone Transfer Monitoring

Zone transfers (AXFR/IXFR) replicate your DNS zones to secondary servers. A broken zone transfer means secondary DNS servers serve stale or missing records. Monitor zone transfer health with a cron heartbeat:

#!/bin/bash
# /opt/technitium/zone-check.sh
HEARTBEAT_URL="https://vigilmon.online/heartbeat/YOUR_ZONE_HEARTBEAT_ID"
API_TOKEN="YOUR_API_TOKEN"
ZONE="yourdomain.com"
DNS_SERVER="your-server-ip"

# Check that the zone is served correctly
ZONE_STATUS=$(curl -s \
  "http://localhost:5380/api/zones/getZone?token=$API_TOKEN&domain=$ZONE" | \
  python3 -c "import sys, json; d=json.load(sys.stdin); print(d.get('status','error'))")

# Also verify resolution from a secondary (if configured)
SECONDARY_CHECK=$(dig @secondary-dns-ip "$ZONE" SOA +short +time=3 2>&1)

if [ "$ZONE_STATUS" = "ok" ] && [ -n "$SECONDARY_CHECK" ]; then
    curl -s "$HEARTBEAT_URL" > /dev/null
else
    echo "Zone check failed: status=$ZONE_STATUS, secondary=$SECONDARY_CHECK"
fi

Schedule this every 15 minutes and set the Vigilmon heartbeat expected interval to 30 minutes. A missed heartbeat means zone sync has broken.

Step 5: Query Rate Alerting

An unusual spike or drop in DNS query rate is often the first sign of a problem — a client misconfiguration flooding the resolver, or an attack. Technitium exposes query stats via its API.

Create a query rate watchdog:

#!/bin/bash
# /opt/technitium/query-rate-check.sh
HEARTBEAT_URL="https://vigilmon.online/heartbeat/YOUR_QUERY_HEARTBEAT_ID"
API_TOKEN="YOUR_API_TOKEN"
# Alert if query rate drops to 0 (resolver stopped answering) or spikes above threshold
MIN_QUERIES=1
MAX_QUERIES=10000

STATS=$(curl -s \
  "http://localhost:5380/api/server/getStats?token=$API_TOKEN&type=LastHour" | \
  python3 -c "
import sys, json
d = json.load(sys.stdin)
stats = d.get('response', {}).get('stats', {})
print(stats.get('totalQueries', 0))
")

if [ "$STATS" -ge "$MIN_QUERIES" ] && [ "$STATS" -le "$MAX_QUERIES" ]; then
    curl -s "$HEARTBEAT_URL" > /dev/null
else
    echo "Query rate out of range: $STATS queries in last hour"
fi

Run this every 30 minutes. Tune MIN_QUERIES and MAX_QUERIES to your normal traffic baseline. A resolver that answers zero queries for an hour almost certainly has a problem.

Step 6: SSL Certificate Monitoring

If you've enabled HTTPS on the Technitium web UI or are using DoH (DNS over HTTPS), certificate expiry breaks both management access and DNS clients.

1. Open the HTTP monitor from Step 1.
2. Enable Monitor SSL certificate.
3. Set Alert when certificate expires in less than 21 days.
4. Click Save.

Verify your TLS setup:

# Check the certificate served by the Technitium web UI (via nginx)
echo | openssl s_client -connect dns-admin.yourdomain.com:443 2>/dev/null | \
  openssl x509 -noout -dates

# Test renewal
certbot renew --dry-run

Step 7: Configure Alert Channels

1. Go to Alert Channels in Vigilmon and connect Slack, email, PagerDuty, or a webhook.
2. For the web dashboard and TCP port monitors, set Consecutive failures before alert to 2 — brief gaps can occur during Technitium's automatic cache maintenance.
3. For DNS resolution and zone transfer heartbeats, alert on the first missed ping — DNS failures propagate fast.
4. Create a maintenance window before Technitium upgrades:

# Pause monitoring before updating
curl -X POST https://vigilmon.online/api/maintenance \
  -H "Authorization: Bearer YOUR_VIGILMON_API_KEY" \
  -d '{"monitor_id": "YOUR_MONITOR_ID", "duration_minutes": 10}'

# Update Technitium (Linux service example)
systemctl stop technitium-dns
# Replace binary / run installer
systemctl start technitium-dns

# Maintenance window expires automatically

Summary

| Monitor | Target | What It Catches | |---|---|---| | Web dashboard | Port 5380 | UI unavailable, .NET crash | | TCP DNS | Port 53 | DNS service not bound | | API health | /api/user/getInfo | API layer failure | | DNS resolution | Heartbeat URL | Resolver not answering queries | | Zone transfer | Heartbeat URL | Secondary sync broken | | Query rate | Heartbeat URL | Resolver flood or complete silence | | SSL certificate | Web UI domain | TLS expiry on DoH or admin UI |

Technitium DNS is the backbone of name resolution for your network — when it fails, everything from web browsing to internal service discovery breaks. Vigilmon monitors every layer of your DNS infrastructure so you detect failures in seconds, not after users start filing tickets.