What Is DNS Monitoring?

The Domain Name System is the infrastructure that translates human-readable domain names into the IP addresses that computers use to route traffic. DNS monitoring is the practice of continuously tracking your DNS records for unauthorized changes, misconfigurations, and availability issues.

Because DNS is the first step in every connection to your services, a problem at the DNS layer affects everything downstream -- web traffic, email delivery, API calls, and certificate validation.

TL;DR

DNS monitoring detects unauthorized record changes, misconfigurations, and domain registration issues before they cause outages or breaches.
Critical records to watch: NS (nameserver delegation), A/AAAA (traffic routing), MX (email delivery), and TXT (SPF/DKIM/DMARC).
DNS hijacking attacks redirect traffic, intercept email, and enable phishing -- all without compromising the actual server.
Automated monitoring shrinks the detection window from days (manual checking) to minutes, limiting the blast radius of attacks.
Dangling CNAMEs pointing to decommissioned services are a top subdomain takeover risk.

DNS Basics: What Records You Are Monitoring

Before you can monitor DNS changes effectively, you need to understand what each record type does and why changes to it matter. DNS is not a single record -- it is a collection of record types, each serving a specific function.

A and AAAA records

A records map your domain to an IPv4 address. AAAA records do the same for IPv6. These are the records that determine where your web traffic goes. If an attacker changes your A record, visitors are sent to a server the attacker controls -- and they have no way to tell the difference from the browser.

NS (Nameserver) records

Nameserver records delegate your domain's DNS to specific authoritative DNS servers. An unauthorized NS change is the most dangerous DNS attack: the attacker gains control of all your records, not just one.

They can point your web traffic, email, and API endpoints wherever they want, and they can issue valid SSL certificates for your domain using DNS-based validation.

MX (Mail Exchange) records

MX records direct email delivery. If an attacker modifies your MX records, all incoming email is routed to their servers. This enables password reset interception, confidential data theft, and business email compromise at scale.

TXT records

TXT records carry critical security policies:

SPF -- defines who can send email as your domain
DKIM -- public keys for email authentication signatures
DMARC -- policies for how receivers handle SPF/DKIM failures
Domain verification tokens -- for services like Google Workspace and Microsoft 365

Unauthorized TXT changes can disable your email security entirely.

CNAME records

CNAME records create aliases, pointing one domain to another. They are commonly used for CDN integration (e.g., cdn.example.com points to d12345.cloudfront.net) and SaaS services. A dangling CNAME -- where the target no longer exists -- is a subdomain takeover risk.

CAA records

Certification Authority Authorization records specify which CAs are permitted to issue certificates for your domain. If CAA records are removed or modified, any CA could issue a certificate for your domain, which undermines the trust model of the web PKI.

Why DNS Changes Matter for Security

DNS is an attractive target for attackers because compromising it gives them control over traffic routing without needing to compromise the actual server. There are several classes of DNS attacks that monitoring can detect.

Common Mistake

Focusing only on server-level security while ignoring DNS. An attacker who compromises your DNS does not need to hack your server -- they simply redirect all traffic to their own infrastructure and impersonate you.

DNS hijacking

The attacker gains access to your DNS management panel (via stolen credentials, social engineering, or registrar compromise) and changes your records to point to their infrastructure. They can serve phishing pages that look identical to your site, intercept API traffic, and collect credentials.

Because the domain is legitimate, even technically savvy users may not notice.

Domain expiry and sniping

If a domain expires and is not renewed during the grace period, anyone can register it. This is called domain sniping. The new owner controls all DNS for the domain, inherits any remaining trust (bookmarks, backlinks, email), and can use it for phishing or malware distribution.

Monitoring domain registration status catches expiry before it becomes a takeover.

BGP hijacking amplified by DNS

Border Gateway Protocol (BGP) hijacks redirect IP-level traffic. When combined with DNS poisoning or modification, the attacker can intercept connections to your domain from specific geographic regions, making the attack harder to detect from your own monitoring location.

Email interception via MX manipulation

Changing MX records redirects all incoming email. This is particularly dangerous for domains that receive password reset emails, financial communications, or sensitive business correspondence. SPF and DMARC records in TXT can be weakened simultaneously to prevent detection by email authentication systems.

What DNS Monitoring Detects

A proper DNS monitoring service continuously polls your DNS records, compares them against a known-good baseline, and alerts you when something changes. Here is what effective monitoring covers.

Record changes with severity classification

Not all DNS changes are equally urgent. A monitoring system should classify changes by severity:

Critical -- NS record changes (domain-level compromise), MX changes (email interception), A/AAAA changes on static-IP infrastructure
High -- TXT changes affecting SPF or DMARC (email authentication weakened)
Medium -- CAA and SRV changes

A/AAAA changes on CDN-fronted domains (Cloudflare, Akamai) are expected and should be suppressed to avoid alert fatigue.

Propagation monitoring

DNS changes propagate through the global resolver network over time, governed by TTL (Time to Live) values. Monitoring propagation ensures that changes you made intentionally have reached all resolvers, and that stale records are not being served from caches.

DNSSEC validation

DNSSEC adds cryptographic signatures to DNS records, preventing forgery. Monitoring checks that DNSSEC signatures are valid and have not expired. A broken DNSSEC chain is as bad as no DNSSEC at all -- resolvers that validate DNSSEC will refuse to resolve your domain.

Domain registration status

Beyond DNS records, monitoring the domain registration itself catches expiry, unauthorized transfers, and critical EPP (Extensible Provisioning Protocol) status changes. EPP statuses like pendingDelete, serverHold, and pendingTransfer indicate urgent issues with your domain registration.

Who Needs DNS Monitoring

Any organization that operates internet-facing services needs DNS monitoring. But the urgency varies.

Organizations with high-value domains. Financial services, e-commerce, healthcare, and government sites are primary targets for DNS hijacking. The payoff for an attacker -- credential theft, financial fraud, data exfiltration -- justifies sophisticated attacks on DNS infrastructure.

Companies with complex DNS configurations. Multi-region deployments, CDN integrations, split-horizon DNS, and microservice architectures create complex DNS configurations where a single misconfiguration can cause widespread outages or security gaps.

Teams managing email for their domain. Email security depends on SPF, DKIM, and DMARC records. If those records change -- whether through an attack or an accidental misconfiguration -- your email authentication breaks, and your messages start landing in spam folders or getting rejected entirely.

Anyone using subdomains for services. SaaS platforms, staging environments, and third-party integrations often use CNAME records pointing to external services. When those services are decommissioned, the dangling CNAMEs become subdomain takeover targets.

Manual DNS Checking vs. Automated Monitoring

You can check DNS records manually with dig or nslookup:

# Check A record
dig example.com A +short

# Check all record types
dig example.com ANY +noall +answer

# Query specific nameserver
dig @8.8.8.8 example.com A +short

Manual checks are useful for troubleshooting, but they cannot substitute for continuous monitoring. DNS hijacking attacks can happen at any hour, and the attacker's goal is to exploit the window between the change and your detection of it.

Automated DNS monitoring shrinks that window from days to minutes, dramatically reducing the blast radius of any attack.

Metric Tower's DNS change detection works by establishing a baseline of your DNS records on the first check, then diffing every subsequent check against that baseline. Changes are classified by severity: NS, A/AAAA, and MX changes are flagged as critical; SPF weakening and DMARC removal are high; CAA, SRV, and general TXT changes are medium.

CDN providers like Cloudflare and Akamai are automatically detected so that expected IP rotation on A/AAAA records does not trigger false alarms.

Best Practice

Enable two-factor authentication on your domain registrar account and apply registry lock if your registrar and TLD support it. These measures prevent unauthorized NS changes at the source -- monitoring catches what prevention misses.

Getting Started

If DNS monitoring is new to your organization, take these initial steps:

Inventory your domains. List every domain and subdomain your organization owns. Include internal domains, staging environments, and any domain used for email.
Document your baseline. Record the current state of all DNS record types for each domain. This is your known-good reference.
Set up automated monitoring. Choose a tool that checks records on a schedule and alerts on changes with appropriate severity classification.
Secure your registrar account. Enable two-factor authentication on your domain registrar. Apply registry lock if your registrar and TLD support it. This prevents unauthorized transfers and NS changes at the source.
Monitor domain expiry. Set up alerts for domain expiration dates, not just DNS record changes.

Key Takeaways

1 DNS is the first link in every connection -- compromising it gives attackers control over traffic routing, email delivery, and certificate issuance without touching your server.
2 Prioritize monitoring NS, A/AAAA, MX, and TXT records -- these carry the highest security risk when changed without authorization.
3 Automated monitoring detects changes in minutes rather than days, and CDN-aware suppression prevents false positives from normal IP rotation.
4 Secure your registrar with 2FA and registry lock, then layer automated DNS monitoring on top as your detection safety net.

For practical guidance on implementing DNS change detection, including which tools to use and which records to prioritize, continue to our guide on how to monitor DNS changes and detect hijacking. If you are evaluating tools, see our comparison of DNS monitoring tools.