Allowlist Our Checks
If your site sits behind bot protection, its challenge page can be served to our monitors instead of your site. Here's how to let our checks through — it takes about two minutes.
What happens without an allowlist
Products like Vercel Bot Protection, Cloudflare's challenges, DataDome, and Imperva ask each visitor to prove they're running a real browser. Your human visitors pass without noticing. Automated uptime checks — ours and everyone else's — can't, so the protection answers them with a challenge page instead of your site.
We recognize those challenge pages and don't report them as downtime (the challenge proves your edge is answering — that's not an outage). But while they last, we can't see the site behind them either: uptime, response-time, content, and page-change monitoring are effectively blind. You'll get a single “our checks are being challenged” alert, and monitoring resumes automatically the moment a check gets through.
What to allowlist
Every check we send identifies itself with this exact User-Agent:
Mozilla/5.0 (compatible; DNS.pizza/1.0; +https://dns.pizza)An allowlist rule matching that User-Agent is all you need. Our checks are read-only GET requests to the URL you monitor, at the cadence you configured — never a crawl.
A note on security: a User-Agent can be spoofed, but exempting it from the challenge doesn't weaken you meaningfully — a bot willing to lie about its User-Agent was never going to solve your JS challenge honestly anyway. If you want the rule tighter, scope it to the exact path your monitor checks, as in the examples below.
Vercel (Bot Protection / WAF)
Project → Firewall → Rules → Add Rule:
- If: User-Agent equals the string above — optionally AND Path equals the path your monitor checks (
/for most). - Then: Bypass.
Custom rules run before the Bot Protection managed ruleset, so the bypass wins.
Cloudflare (WAF / Bot Fight Mode)
Domain → Security → WAF → Custom rules → Create rule:
- Expression:
(http.user_agent eq "Mozilla/5.0 (compatible; DNS.pizza/1.0; +https://dns.pizza)") - Action: Skip — tick the challenge products you have enabled (Bot Fight Mode, Managed Challenge, Super Bot Fight Mode).
DataDome / Imperva
Both support User-Agent (or signature-based) allowlists in their dashboards: look for Allowlist in DataDome's protection settings, and Security → Whitelist settings in Imperva. Add the User-Agent string above as an exception.
After you add the rule
Nothing to do on our side — the next scheduled check passes through, the challenge notice clears on its own, and your monitor picks up where it left off. Challenged intervals are never counted against your uptime history.