Troubleshooting

Solutions for common DriftSensor issues - domain errors, notification failures, integration problems, and more.

Domain Issues

Domain shows "Error" status

This means DNS resolution is failing consistently. Common causes:

The domain doesn't exist or has expired.
DNS servers are temporarily unreachable.
A firewall is blocking DNS queries from external resolvers.

DriftSensor queries from Google (8.8.8.8), Cloudflare (1.1.1.1), and Quad9 (9.9.9.9). If your domain resolves locally but not from these public resolvers, check your DNS hosting configuration.

After 10 consecutive failures, the domain is automatically paused. Fix the underlying DNS issue, then reactivate the domain from the Domains page.

"Domain not found" error when adding a domain

Verify the domain name is correct and publicly resolvable. DriftSensor cannot monitor internal/private DNS zones. The domain must resolve from at least one public DNS resolver.

DNS changes not detected

First check baseline - The first monitoring run establishes a baseline and does not generate alerts. Wait for the second check cycle.
Smart detection filtering - Changes to CDN IPs, GeoDNS-rotated addresses, and known dynamic hosts are intentionally suppressed to prevent false positives.
Check interval - Drift is only detected at your configured check interval. If you set 24-hour checks, changes made between checks won't be reported until the next scheduled run.
Oscillation suppression - If the same drift was resolved within the last 6 hours, it won't re-trigger. This prevents alert storms from flapping records.

Too many false positives

DriftSensor's smart detection handles most cases automatically. If you're still seeing false positives:

Verify that CDN CNAME records are properly configured (DriftSensor recognizes CloudFront, Cloudflare, Akamai, Fastly, Vercel, Netlify, and other major CDNs).
For hosts behind load balancers that rotate IPs, the system should auto-detect rotation after observing resolver disagreement. Allow 1–2 check cycles for detection to activate.
Accept known changes via the Accept Change action on individual drift items to update your baseline.

After making DNS changes, records may take time to propagate globally. DriftSensor may detect "missing" or "changed" records during propagation. Once propagation completes, the drift will either auto-resolve or you can accept the new values as your updated baseline.

Alert & Notification Issues

Not receiving email notifications

Verify Email Notifications is enabled in Settings → Notifications.
Check if Critical Alerts Only is enabled - this suppresses normal and low-severity alerts.
Check if Daily Digest is enabled - alerts are batched into a daily summary instead of being sent immediately.
Check your spam/junk folder.
If you're a Tenant Admin, check the Notification Email Address in Settings - if configured, alerts are sent to that address and always bypass individual preferences.

Webhook automatically disabled

Webhooks are disabled after 10 consecutive delivery failures. To fix:

Go to Settings → Webhooks.
Check the Last Error message for the disabled webhook.
Verify your endpoint is accessible and returns a 2xx status code within 10 seconds.
Ensure the URL uses HTTPS and points to a public IP (private/internal IPs are blocked).
Re-enable the webhook - the failure counter resets on the next successful delivery.

Teams integration not working

Verify the webhook URL is a valid Microsoft Teams or Power Automate URL.
The URL must use HTTPS.
Like webhooks, Teams integrations are auto-disabled after 10 consecutive failures.
Teams integration requires the Professional or MSP plan.

Authentication Issues

Your account locks after 5 failed attempts within a short window. The lockout lasts 15 minutes and unlocks automatically - no action needed. The login page shows: "Account is locked due to too many failed attempts. Please try again in X minutes."

MFA code not working

Email MFA - Codes expire quickly. Click Resend code to get a fresh one. Check your spam folder.
TOTP (Authenticator App) - Ensure your device clock is accurate. TOTP codes are time-sensitive with a ±30 second tolerance window. If your device clock is significantly off, codes will be rejected.
Backup codes - Each backup code can only be used once. If you see "Invalid code," the code may have already been used.

Lost authenticator app access

If you have unused backup codes, use one to log in. Then go to Settings → Two-Factor Authentication → Disable the authenticator app, and set it up again on your new device.

If you've lost both your authenticator app and all backup codes, contact support for manual account recovery.

Password reset link expired

Password reset links expire after 1 hour. Request a new one from the login page by clicking Forgot Password.

Plan & Billing Issues

Features disappeared after cancellation

When your subscription ends (after cancellation or payment failure), DriftSensor enforces the Free plan's limits:

Resource	Enforcement
Domains	Excess domains paused (oldest kept active)
Users	Excess read-only users deactivated (admins kept)
Check intervals	Raised to minimum allowed by new plan
Webhooks	Excess disabled; all disabled if not available
API keys	Disabled if API not available on new plan
Teams integrations	Disabled if not available on new plan

Upgrade your plan to restore access to paused/disabled resources.

Trial expired unexpectedly

Free trials last exactly 7 days. A reminder email is sent 2 days before expiration. After expiration, your account automatically moves to the Free plan with its limits enforced.

Can't add more domains / users / webhooks

You've reached your plan's limit. The error message tells you the exact limit: "Domain limit reached. Your Standard plan allows 10 domain(s)." Upgrade to a higher plan or, for MSP accounts, purchase an addon domain pack.

API Issues

"Invalid API key format" error

API keys must start with ds_live_. Make sure you're using the full key value and sending it in the X-API-Key header.

"API access is not available on your current plan"

API access requires the Professional or MSP plan. If your subscription was recently canceled or expired, your existing API keys were disabled. Upgrade your plan to restore access.

Rate limit exceeded

Rate limits are shared across all API keys on your account:

Burst: 50 requests per minute.
Daily: 5,000 (Professional) or 50,000 (MSP) requests per day.

If you're hitting limits, reduce request frequency or upgrade to the MSP plan for higher limits.

API key rotation - old key stopped working

When you rotate a key, the old key has a 24-hour grace period during which both old and new keys work. After 24 hours, the old key expires permanently. Update your integrations to use the new key within the grace period.

Import Issues

CSV import failing

CSV import requires the Standard plan or above. The expected format is:

domain,group,interval,ns1,ns2,ns3,ns4
example.com,Production,5min,,,
mysite.org,Staging,1hr,,,

Common issues:

The file must use comma-separated values with a header row.
interval must be one of: 5min, 15min, 30min, 1hr, 6hr, 12hr, 24hr and allowed by your plan.
Domain names must be valid and not already exist in your account.
group is optional - groups are auto-created if they don't exist.
ns1-ns4 are optional - nameservers are auto-detected if omitted.

Knowledge Base - Browse detailed articles in Settings → Knowledge Base.
AI Chatbot - Available 24/7 for instant answers to common questions.
Support Tickets - Create a ticket directly from the chatbot or Settings → Support Tickets. Include your domain name and a description of the issue.

Response times by plan: Free = best effort, Standard = 24–48 hours, Professional = 4–8 hours, MSP = 1–2 hours.