myOwnDN logo

myOwnDN

Self-hosted monitoring for a portfolio of registered domain names: registration, DNS and DNSSEC, TLS certificates, Certificate Transparency, email authentication, availability and DMARC analytics. Notifies each domain's responsible owners only when something actually changes.

self-hostedsource-availableno paid APIs no phone-homeSQLite / MariaDBPython ≥ 3.13
/how-it-works

How it works

Data flow: domains through seven check modules into the change-detection engine and out to notification channels
domains → 7 check modules → snapshots · change detection · policy → channels → owners
engine

Change-driven

diff vs last-notified state · steady state is silent · RDAP/WHOIS flap noise filtered · recoveries announced
sources

Self-hosted-first

RDAP/WHOIS · live DNS · direct TLS · crt.sh · DNSBL — free public sources, no keys, no phone-home
scope

Right-sized

built for 1–50 domains · per-domain owners, check selection and notification policy
/checks

Seven checks

Registration & expiry

RDAP-first / WHOIS-fallback
registrar · expiry countdown
EPP transfer lock · registry NS

DNS & DNSSEC

NS A/AAAA CNAME MX TXT CAA SOA
SOA-serial change tracking
DS/DNSKEY chain · RRSIG expiry

TLS / SSL

apex + www · expiry · trust chain
hostname match · weak TLS
ACME detection

Certificate Transparency

crt.sh log query
unexpected issuers · mis-issuance
cross-checked against CAA

Email authentication

SPF · DKIM selector probing
DMARC posture · MX health
optional SMTP banner · RBL/DNSBL

HTTP availability

apex + www HTTPS reachability
HTTP→HTTPS redirect

DMARC analytics

rua/ruf ingestion (IMAP or upload) · pass rate / alignment / disposition · spoof-source alerts · forensic samples · monthly per-domain reports
/features

Around the checks

policy

Notification policy

severity floor (global + per-domain) · rate-limit · reminders · 10 categories · per-check suppression · alert-after-N-failures · editable templates with live preview
channels

Delivery

Email (SMTP) · Slack · HMAC-signed webhook · HTTPS push · encrypted secrets at rest · per-channel test · owner routing with admin fallback
ui

Dashboard & UI

status rollup · needs-attention · expiring-soon · per-facet grid · per-check ⓘ help · favicons · three themes · logs page
tools

DNS Tools

suggested records for email auth / autoconfig / service discovery / TLS / transport security · live gap-check · SPF & DMARC builders · CAA from live issuer
security

Accounts

per-account TOTP 2FA (default-on, skippable) · backup codes + emailed recovery + CLI reset · scrypt · CSRF everywhere
ops

Deployment

Docker Compose (app + scheduler + nginx TLS) · SQLite or MariaDB · automatic migrations · full CLI · MYOWNDN_* env config

The full feature matrix (about fifty rows) ships with the source as docs/features.md.

/screenshots

Screenshots

Dashboard with sample domains
dashboard · rollup, needs-attention, all-domains grid (sample data)
Domain detail with sample data
domain detail · severity-coded results with per-check help (sample data)
/install

Install

  1. Clone the repository and generate a self-signed certificate for the bundled nginx proxy (replace with a real one for anything internet-facing):
git clone <repo> myowndn && cd myowndn
scripts/gen-tls-cert.sh dns.example.internal
  1. Start the stack; SQLite lives on a named volume. Add the MariaDB overlay file if you prefer MariaDB:
docker compose up -d --build
  1. Read the one-time setup token and finish in the browser:
docker compose logs ca | grep "setup token"
# then open https://<host>/setup — admin, TOTP (or skip), instance

The scheduler sidecar runs the check/notify cycle on its own; no host cron.

  1. Python 3.13 or newer is required. Create a venv and install:
python3 -m venv .venv && .venv/bin/pip install -e .
  1. Run the server and complete the setup wizard at http://localhost:8900/setup:
MYOWNDN_STATE_DIR=./var MYOWNDN_SECRET=change-me \
MYOWNDN_COOKIE_SECURE=false .venv/bin/myowndn-serve
  1. Schedule the cycle with cron:
0 * * * *   myowndn run          # checks + notifications
15 * * * *  myowndn dmarc fetch  # DMARC mailbox ingestion

Requirements: outbound DNS, RDAP/WHOIS and HTTPS (crt.sh); all free public sources, no API keys. Step-by-step details, MariaDB, upgrades and troubleshooting live in the repository's INSTALL.md.

/license

License

personal

PolyForm Noncommercial 1.0.0

source-available · free for personal and noncommercial use · full license text ships with the source
commercial

Commercial license

required for business use · signed key from BitBreakers · verified fully offline (works air-gapped) · nothing is feature-gated

The source repository is being published on GitHub; the link will appear here.

/contact

Contact

Questions, commercial licensing or bug reports. The form composes a message in your own mail client; nothing is sent to or stored by this site.

or write directly: contact@myowndn.com