DNS

How to monitor DNS record changes

A changed DNS record can silently reroute your traffic, break your email, or hand your domain to an attacker. Here's how to watch your records and get alerted the moment one changes.

DNS is the layer everyone forgets until it fails. Records are edited by hand, by a registrar's dashboard, by a Terraform run, or by an attacker who got into your DNS provider — and the effects are immediate and invisible from your servers. Your app is healthy; your A record now points somewhere else. Monitoring your DNS records means you find out in minutes, not when customers report the site is "someone else's page."

What can go wrong

  • A / AAAA record changed — traffic silently rerouted to the wrong server (misconfiguration or hijack).
  • MX record changed or dropped — email stops being delivered, often noticed days later.
  • NS record changed — someone moved your domain's authority; a classic domain-hijack signal.
  • TXT / SPF / DKIM edited — email starts landing in spam, or a domain-verification breaks.
  • CNAME dangling — points at a deprovisioned service, a subdomain-takeover risk.

How DNS monitoring works

The idea is simple: on a schedule, resolve a specific record and compare the answer to the value you expect. If the live answer no longer matches, alert. Because DNS answers are small and deterministic, this is cheap to run frequently and gives you a precise "expected vs actual" signal — not a vague "something's off."

Setting it up in MonitorSpider

Create a DNS monitor and specify:

  • The domain / hostname to query (e.g. example.com or mail.example.com).
  • The record type — A, AAAA, MX, NS, TXT, CNAME.
  • The expected answer — the value the record should currently hold.

MonitorSpider resolves the record each interval and flips to ERROR if the expected value isn't present, so you're alerted to both an unexpected change and a record that vanished entirely. Alerts go by email on any plan, and to Slack, Telegram, or webhook on Premium.

What to actually watch

  • Your apex A record and www — the ones that route your traffic.
  • MX records for any domain that sends or receives mail.
  • NS records — a change here is rarely something you did.
  • SPF/DKIM/DMARC TXT records if email deliverability matters to you.

Set the expected value to what's correct today, and remember to update the monitor when you make a legitimate DNS change — otherwise your own planned change will (correctly) alert.

For agencies and MSPs

DNS monitoring is one of the highest-signal, lowest-noise checks you can run for clients. A dangling CNAME or an unexpected NS change is exactly the kind of thing clients never notice and never forgive. One DNS monitor per critical record, alerts to a shared channel, and you're covering a failure mode most competitors ignore.

Watch your DNS records for silent changes. Create a free account — DNS monitoring is included on every plan.
Keep reading