DNS decides where your traffic and email go. Change one record and visitors land on another server, mail goes to someone else, or certificate issuance fails. Most DNS changes are planned. The dangerous ones are not: a typo during a migration, a removed TXT record that breaks email verification, or an attacker with access to your registrar account pointing your domain somewhere else.
A hijacked domain often keeps working for a while. Pages may even look the same. That is why DNS monitoring watches the records themselves, not just whether the site loads. Our guide on detecting hijacked DNS records covers the warning signs.
Records Uptimecheck watches
- A and AAAA: where your domain points over IPv4 and IPv6.
- CNAME: aliases such as www or a CDN hostname.
- MX: which servers receive your email.
- NS: which name servers are authoritative for the domain.
- SOA: the zone’s start of authority and serial.
- TXT: SPF, DKIM, DMARC and verification records.
- CAA: which certificate authorities may issue for the domain.
Each DNS monitor watches one record type on one name, checked as often as every minute. Optionally, enter the values you expect, and the check fails whenever the records do not match them exactly.
What a change alert looks like
At 09:41 the MX record for northwind.shop changes from mx1.northwind-mail.com to mx.unknown-host.net. Nobody filed a change. Uptimecheck sends the alert with the old and new value. The team locks the registrar account, restores the record and checks the access log, all before most of the day’s order confirmations would have gone astray.
History for audits and rollbacks
Every change is kept with a timestamp. When a migration goes wrong, you can see exactly what the records looked like before, instead of guessing from memory or an old screenshot. Agencies can use the history to show a client what changed and when.
Part of a complete domain check
A domain needs a valid registration, correct records and a valid certificate. Pair DNS monitoring with domain expiry monitoring and SSL monitoring. If your records point to the wrong server, uptime checks with response checks will usually catch the symptom too.
Which records to watch first
Start with the records an attacker or a careless change would hurt most. NS records decide who controls the zone, so a change there is always worth a look. A and AAAA records decide where your site loads from. MX records decide who receives your email, including password reset messages. TXT records hold SPF, DKIM and DMARC, and a removed record can send your newsletters straight to spam. Email authentication monitoring checks those three for mistakes as well as changes.
Planned changes
When you change a record on purpose, the alert confirms that the change went live and what the previous value was. Keep the history as part of your change log, so the next migration starts from facts.
Alerts go to email, Slack, Microsoft Teams, Discord, Google Chat, Mattermost, Telegram, PagerDuty, ntfy, Pushover, webhooks and push notifications on every plan. DNS monitors can also be created through the REST API. Start includes 10 DNS monitors, Professional 25 and Business 150.
Plans start at €9 per month billed yearly or €12 billed monthly, excl. VAT. See the pricing page for plans, or start a 14-day free trial without a card.