DNS Monitoring: How to Detect Changed or Hijacked Records

DNS monitoring watches your domain’s DNS records and alerts you the moment one of them changes. That matters because a changed record does not cause an obvious outage. If someone points your domain at another server or your mail records at another provider, everything can look normal while traffic and email go somewhere else. DNS monitoring compares the records themselves, so it catches changes that uptime checks can miss.

Why DNS changes are dangerous

DNS translates your domain name into the addresses of your web and mail servers. Whoever controls those records controls where your visitors and your email go. Changes happen for three reasons:

• Planned changes: a server migration, a new email provider, a CDN switch. These are fine, but you want confirmation they went live correctly.
• Mistakes: a colleague edits the wrong record, a provider migration drops a TXT record, a TTL change has side effects.
• Hijacking: someone gains access to your registrar or DNS provider account, often through a phished password, and changes the records.

With a hijack, the attacker can show visitors a copy of your login page, intercept email, or issue themselves certificates for your domain. Monitoring cannot stop someone from logging in, but it shortens the time before you notice from days to minutes.

The DNS records to watch

Each record type controls something different. A good DNS monitor covers all of them:

• A and AAAA: the IPv4 and IPv6 addresses of your website. A change sends visitors to a different server.
• CNAME: aliases, often used for www, CDNs and third-party services. A change can hand a subdomain to someone else.
• MX: where email for the domain is delivered. A change can redirect all incoming mail.
• NS: which nameservers are authoritative for the domain. A change hands control of every other record to whoever runs the new nameservers. Treat this as the most critical alert.
• SOA: the zone’s start-of-authority record, including a serial number that changes with every zone update. A change here tells you the zone was edited.
• TXT: SPF, DKIM, DMARC and domain verification records. Changes affect whether your email is trusted and who can verify ownership of your domain with other services.
• CAA: which certificate authorities may issue certificates for your domain. A change can open the door to certificates you did not request.

How DNS monitoring works

1. You add a domain and choose the record types to watch.
2. The monitor resolves the records regularly and stores the current values.
3. When a value differs from the last known value, you get an alert showing the old and new records.
4. The change is kept in a history, so you can see exactly what changed and when.

Uptimecheck monitors A, AAAA, CNAME, MX, NS, SOA, TXT and CAA records, keeps a change history and sends an alert on every change.

What normal change looks like

Some records change on their own, and you should know which. The SOA serial number increases with every zone edit, so any change you make anywhere in the zone shows up there too. Some DNS providers rotate records for load balancing or failover, which can make A records change regularly. CDNs may return different addresses for different locations.

Before relying on alerts, watch your records for a week. Note which ones change as part of normal operation, and make sure the team knows what an expected change looks like. After that, any change outside the pattern deserves a closer look.

Monitoring email authentication

TXT records deserve special attention because they decide whether your email reaches inboxes:

• SPF lists the servers allowed to send email for your domain. If it changes unexpectedly, someone may have added their own server.
• DKIM publishes the public key that receiving servers use to verify your signatures.
• DMARC tells receivers what to do with mail that fails those checks.

A broken or removed record can send your newsletters, invoices and password resets to spam. A record that adds an unknown sender can let someone send mail that looks like yours. Both show up as a TXT change.

Responding to a DNS change alert

When an alert arrives, work through it quickly:

1. Was it planned? Check with whoever manages DNS. If yes, confirm the new values are correct.
2. If not, compare the values. Is the new IP address yours? Does the new MX host belong to your email provider? Are the new nameservers your DNS provider’s?
3. Secure the accounts. If the change was not yours, change the passwords for the registrar and DNS provider, check who has access and enable two-factor authentication.
4. Restore the records from the history.
5. Contact your registrar if you cannot regain control, especially after an NS change.
6. Check for side effects: certificates issued during the window, email received by the wrong server, and visitors who may have seen a fake page.
7. Tell customers if their data may have been affected, and use your status page for updates.

Preventing DNS hijacks

Monitoring detects. These steps make a hijack harder in the first place:

• Turn on two-factor authentication for registrar and DNS provider accounts.
• Enable registrar lock so the domain cannot be transferred without extra steps.
• Keep the number of people with access small and review it regularly.
• Use a CAA record to limit which certificate authorities can issue certificates.
• Keep registrar contact details current so security emails reach you.
• Monitor domain expiry too. An expired domain is the easiest kind of takeover. See domain monitoring.

DNS monitoring checklist

1. List all domains you own, including redirect and campaign domains.
2. Add DNS monitors for NS, A, AAAA, CNAME, MX, TXT, SOA and CAA.
3. Send DNS alerts to a shared channel that is read quickly.
4. Agree that every planned change is announced, so unplanned ones stand out.
5. Secure registrar and DNS accounts with 2FA and registrar lock.
6. Add domain and SSL monitoring for the same domains.
7. Review the change history after every migration.

Summary

DNS changes are silent: no error page, no failed check, just traffic going somewhere else. Monitoring the records themselves, with alerts and history, makes every change visible within minutes.

DNS monitoring is included in Uptimecheck together with uptime, SSL, domain and server monitoring. Try it free for 14 days, no credit card required.