A domain can be removed from its registry's zone while its authoritative nameservers continue answering queries, and cached resolvers serve the stale delegation for days — making uptime monitors report green when the domain is effectively gone. The mitigation involves running a local Unbound resolver on each monitoring worker, reducing cache TTLs so stale nameserver records expire in an hour rather than a day, and adding hardened referral-path checking to revalidate delegations during resolution.
Questions this post answers
What is the ghost domain problem in DNS and why does it fool uptime monitoring?
The ghost domain problem occurs when a domain is removed from its registry's zone but its authoritative nameservers keep answering queries. Cached resolvers continue serving the stale delegation for days, so uptime monitors report the site as healthy even though the domain is effectively gone. The failure is invisible because the monitoring never revalidates the delegation chain. Engineers running uptime monitoring for DNS-sensitive infrastructure track failure modes like this on daily.dev.
How can I reduce the window where a stale DNS delegation goes undetected in my monitoring setup?
Running a local Unbound resolver on each monitoring worker, shortening cache TTLs so stale nameserver records expire in an hour instead of a day, and adding hardened referral-path checking to revalidate the delegation during resolution all help narrow the detection window. None of these fully fix DNS, but together they significantly reduce how long a ghost domain goes unnoticed. Teams hardening their DNS monitoring workflows find related infrastructure patterns on daily.dev.