Stop DNS Hijacking Before Your Customers Notice
Your zone changes silently. We diff it on a schedule and tell you exactly what moved.
- Every record diffed, not a page pinged
- A faster lane for nameserver and SOA changes
- Confirmed on a second resolver before alerting
No credit card required.
01. The Threat
The Invisible Threat of DNS Hijacking
Most organizations spend millions securing their web apps, but leave the foundation of their digital presence unguarded. DNS Hijacking occurs when an attacker maliciously alters your records to route your traffic to a fraudulent website.
"Because a DNS hijack happens at the routing layer, your web application firewalls (WAF) and server logs will show absolutely zero signs of a breach, while your customers are actively being routed to a phishing site."
Without automated DNS change detection, a hijacked domain can go unnoticed for days. By the time emails bounce or customers report a cloned site, the damage is already done.
"event": "dns.records_changed",
"domain": "api.yourcompany.com",
"changes": { "A": {
"changed": [{
"name": "api.yourcompany.com",
"from": "104.21.55.12",
}] }
}
}
Zero-Trust DNS Auditing
We don't rely on your registrar's internal notifications, which attackers often disable. We query your domain's own authoritative nameservers from the outside in, and confirm every change against a second independent resolver before we ever raise an alarm.
Baseline snapshot
We record the exact state of your A, AAAA, MX, NS, and TXT records as the trusted source of truth.
Authoritative polling
We query your domain's own authoritative nameservers on a tiered schedule, with delegation (NS/SOA) on a faster lane (hourly on Business), so a hijack is caught before any cache would show it.
Corroborated diff
We compare the live response against your known zone by record identity, then re-check any difference against a second resolver. If they disagree, nothing fires, so a glitchy resolver never becomes a false alarm.
Instant alerting
The millisecond a drift is detected, an alert payload is fired to your DevOps team via Slack or Webhook.
ns1.cloudflare.com · ns2.cloudflare.com
ns1.attacker-dns.xyz · ns2.attacker-dns.xyz
Live nameservers do not match the registrar's record. Possible hijack.
The Fast Lane
Your Nameservers Are Watched More Closely Than Anything Else
Whoever controls your nameservers controls your entire zone: the site, the mail, and the certificates. So delegation gets its own lane, checked far more often than the rest of the zone, as frequently as hourly on the Business plan.
- Asked at the source: we query your domain's own authoritative servers for NS and SOA, so a change is seen before any cache would reveal it.
- Cross-checked against your registrar: if the live nameservers disagree with the ones on record at your registrar, that mismatch is flagged on its own. It is one of the strongest early hijack signals there is.
- Its own alert: a delegation change arrives as a distinct, top-priority alert, never buried among routine record edits.
Critical Records You Must Monitor
A comprehensive security posture requires monitoring every layer of the DNS stack. Changes to different record types signal different types of catastrophic failures.
Traffic routing
These records point your domain to a physical server IP. Unauthorized changes mean your web traffic is being actively hijacked and routed to a cloned phishing site.
Mail exchange
Controls where incoming emails are sent. Attackers silently change this to intercept password resets, financial invoices, and sensitive internal communications.
Email authentication (SPF/DKIM/DMARC)
Authorises your outgoing mail. A dropped include:, a rotated DKIM selector, or a DMARC policy relaxed to p=none costs you deliverability with no error anywhere.
SPF, DKIM & DMARC monitoringNameserver authority
The keys to the kingdom. If nameservers are changed at the registry level, the attacker controls your entire DNS zone file. We alert you the moment authority shifts.
Service mapping
Attackers hunt for dangling CNAME records pointing to discontinued third-party services (like Heroku or AWS S3). If detected, they can claim the bucket and hijack your subdomain.
Certificate issuance
Dictates which Certificate Authorities can issue SSL certificates for your domain. Monitoring this prevents attackers from modifying the record to issue a fraudulent certificate for phishing.
Slack & Discord
Route alerts directly to `#devops-alerts` ensuring the on-call engineer sees it immediately.
Global Propagation
Track which geographic regions have recognized your new configuration and which are lagging.
Smart Throttling
We utilize intelligent debouncing. If you are intentionally migrating a massive zone file, we summarize the changes rather than flooding your endpoints with 50 individual alerts.
04. Integration
Built for Incident Response
Data without delivery is useless. When a core infrastructure change is detected, your team needs to know immediately, in the tools they already use.
Our Developer Webhooks push structured JSON payloads to your custom incident management tools (like PagerDuty or Opsgenie), allowing you to trigger automated lockdown scripts the second drift is detected.
Explore Notification ChannelsStart Monitoring & Catching Domains Today
Join founders, agencies, and domainers already protecting their portfolio. Your first 5 domains are free.
No credit card required • Cancel anytime
Frequently Asked Questions
Technical details regarding our DNS monitoring engine.
What is DNS change detection?
DNS change detection continuously polls your domain's authoritative nameservers from multiple global locations. It compares active DNS records (A, AAAA, MX, CNAME, TXT, NS) against a baseline snapshot and alerts you immediately if any records are added, removed, or altered.
Why is monitoring DNS changes important?
DNS records control where your web traffic flows, where your emails are routed, and how your domain is verified. Unauthorized changes can result in traffic redirecting to malicious phishing sites, emails being intercepted, or domain verification records (SPF/DKIM) being manipulated.
How fast does your system detect a DNS change?
DNS records are checked on a tiered schedule for paid plans: the full zone twice a day on Business and daily on Pro, while your nameservers get their own faster lane, checked as often as hourly. A change is detected on the next check for that lane, confirmed against a second resolver, and alerts are dispatched instantly via email or webhooks.
Does this check detect propagation issues?
Yes. By querying nameservers from multiple global edge locations, our tool can verify whether your DNS changes have successfully propagated globally or if certain regions are still receiving cached records.
What types of DNS records are supported?
We support monitoring for all standard DNS records, including A (IPv4 addresses), AAAA (IPv6 addresses), MX (mail servers), NS (nameservers), CNAME (canonical names), TXT (text records used for SPF, DKIM, and site verification), and CAA (certificate authorities).
Can DNS monitoring detect DNS hijacking or poisoning?
Yes. DNS hijacking occurs when attackers gain access to your registrar or DNS provider to redirect traffic. Because we query your records directly from your authoritative nameservers, and give nameserver delegation its own faster check lane, an unauthorized modification is caught quickly and raised as its own top-priority delegation alert. We also compare your live nameservers against the ones your registrar has on record and flag any mismatch, which is one of the strongest early hijack signals there is. Every change is confirmed against a second independent resolver, so cache poisoning does not turn into a false alarm.
Will DNS monitoring impact my website's performance or server load?
No. Our check consists of lightweight, standard DNS queries sent directly to your domain's nameservers. It generates virtually zero overhead and will not affect the speed, bandwidth, or performance of your website or nameserver.