Technical guide
How to monitor DNS record changes
Reliable drift detection compares normalized record sets, not screenshots or response ordering.
The problem
DNS answers are cached, distributed, and often contain multiple values. Raw text diffs create noise, while incident-only checks miss when a meaningful change first appeared.
Risks and assumptions
Traffic rerouting after resolution or delegation changes.
Mail disruption caused by MX or authentication-record edits.
False alarms caused by ordering, TTL, or planned propagation.
Procedure
Choose critical records
Cover A/AAAA, CNAME, MX, NS, SOA, CAA, and relevant security TXT records.
Create a normalized baseline
Sort values, normalize names, and compare content separately from TTL.
Set a proportionate cadence
Match frequency to service criticality, TTL, and expected change rate.
Classify the diff
Separate additions, removals, value changes, and delegation changes.
Confirm propagation and ownership
Check authoritative data and correlate timing with an approved change.
Limits of a manual approach
Recursive resolvers may disagree during propagation.
DNSSEC validates authenticity, not whether an internal owner approved a change.
Dynamic records need different alert policies from security controls.
Example
During a planned mail migration, old and new MX values may coexist. A useful alert shows the before/after set and timestamp instead of declaring an incident automatically.
Common mistakes
Treating answer ordering as a change.
Alerting on TTL without context.
Ignoring NS, CAA, or TXT because the website still loads.
Recommendations
Correlate changes with tickets or deployment windows.
Show exactly what was added or removed in alerts.
Keep monitoring read-only; do not auto-repair DNS.
Frequently asked questions
Is a TTL change an incident?
Not by itself. It may precede a migration or operational adjustment and needs context.
How soon will a change be visible?
It depends on authoritative publication, caches, TTL, delegation, and the resolver used.
Can public DNS identify who changed a record?
Usually not. Correlate with audit logs from the DNS provider.
Keep a DNS change history
Compare snapshots and receive explainable alerts for authorized domains.
Explore the moduleRelated content
Domain trust
DNS and email security monitoring
Detect DNS record changes and monitor SPF, DKIM, DMARC, MX, nameserver, MTA-STS, and TLS-RPT posture across your domains.
Free tool
DNS record checker
Get a point-in-time view of public DNS resolution, mail, delegation, CAA, and TXT records without changing the zone.
Technical guide
How to check SPF, DKIM, and DMARC correctly
Check SPF, DKIM, and DMARC syntax and alignment, understand common errors, and learn why a single pass does not guarantee protection.