How to Monitor DNS Records for Unexpected Changes

DNS records are a high-value target. A single unauthorized change to an A record can redirect your entire website to an attacker's server. A modified MX record can silently intercept all your email. And because DNS changes propagate globally, the blast radius is enormous.

Monitoring your DNS records for unexpected changes is not optional. It is a core part of domain security and operational reliability. This guide covers what to watch for, how to set up monitoring, and what to do when you detect an unauthorized change.

Why DNS Monitoring Matters

Most organizations only check their DNS when something breaks. By that point, the damage is done. A hijacked A record means your users have been visiting a phishing site. A changed MX record means someone has been reading your email. A deleted TXT record means your email authentication is broken and spam is being sent from your domain.

DNS monitoring closes the gap between when a change happens and when you find out about it. The goal is detection in minutes, not days.

What DNS Changes to Monitor

Not all record types carry the same risk. Prioritize monitoring based on impact.

Critical Records

Important Records

Manual Monitoring Approaches

If you are just getting started, manual monitoring is better than no monitoring at all.

Scheduled dig Checks

Create a simple script that runs dig queries on a schedule and compares results against a known-good baseline:

# Save current A record for comparison
dig example.com A +short > /tmp/dns-baseline-a.txt

# Later, compare against baseline
dig example.com A +short | diff /tmp/dns-baseline-a.txt -

You can run this via cron on a Linux server or as a scheduled task on Windows. If the diff produces output, the record has changed.

Spreadsheet Tracking

For smaller domain portfolios, a spreadsheet listing all records with their expected values works as a manual audit tool. Check each record weekly or monthly against the live DNS data.

Limitations of Manual Monitoring

Manual approaches have significant drawbacks:

• Slow detection: You only find changes at your next check interval
• Human error: Easy to miss a record or misread output
• No off-hours coverage: Nobody is checking at 3 AM
• Does not scale: Impractical for more than a handful of domains

Automated DNS Monitoring

Automated monitoring solves every limitation of manual checks. A monitoring service queries your records at regular intervals from multiple global locations and alerts you immediately when something changes.

What to Look for in a DNS Monitoring Tool

Setting Up Effective DNS Monitoring

Responding to Unexpected DNS Changes

When your monitoring detects an unauthorized change, time is critical. Follow this response process:

Immediate Actions

1. Verify the alert is real: Query the record yourself from multiple resolvers to confirm the change
2. Check your DNS provider's audit log: Determine if someone on your team made the change intentionally
3. Assess the impact: Is traffic being redirected? Is email being intercepted? Is a service broken?

If the Change Is Unauthorized

1. Revert the record immediately to its correct value at your DNS provider
2. Rotate credentials for your DNS provider account and registrar account
3. Enable two-factor authentication if it was not already active
4. Check for other changes: An attacker who changed one record may have changed others
5. Review registrar-level settings: Confirm the domain lock is enabled and contact information is correct
6. Notify affected parties: If user data may have been compromised, follow your incident response process

Real-World DNS Attack Scenarios

Understanding attack patterns helps you configure monitoring effectively:

• Domain hijacking via registrar compromise: Attacker gains access to your registrar account and changes NS records, taking full control of your DNS zone
• DNS cache poisoning: Attacker injects false records into a resolver's cache, redirecting queries without changing your authoritative records
• Subdomain takeover: A CNAME record points to a deprovisioned cloud resource (like an old Azure or Heroku app). An attacker claims that resource and serves content on your subdomain
• MX record hijacking: Attacker changes MX records to route email through their servers, capturing sensitive communications
• BGP hijacking affecting DNS: Attacker reroutes traffic to your nameservers at the network level, serving false responses to queries

Each of these scenarios is detectable through DNS monitoring, assuming you are checking from multiple locations and comparing against a known-good baseline.

DNS monitoring is one of the highest-value security investments you can make for your domain portfolio. The cost of not monitoring is measured in compromised accounts, stolen data, and damaged reputation. Set up automated monitoring now, before you need it.