Stop DNS Hijacking Before Your Customers Notice
DNS change detection compares your live DNS records with the last known zone and alerts you when one is added, removed or changed.
- Every record diffed, not a page pinged
- A faster lane for nameserver and SOA changes
- Confirmed on a second resolver before alerting
The Invisible Threat of DNS Hijacking
Most organizations secure their applications and leave the layer that points at them unwatched. DNS hijacking is when an attacker changes your records to send your traffic or mail somewhere else.
Because a DNS hijack happens before a request ever reaches you, your firewall and server logs show nothing unusual while visitors are sent to someone else’s server.
Without automated DNS change detection, a hijacked domain can go unnoticed for days. By the time emails bounce or customers report a cloned site, the damage is already done.
"event": "dns.records_changed",
"domain": "api.yourcompany.com",
"changes": { "A": {
"changed": [{
"name": "api.yourcompany.com",
"from": "104.21.55.12",
}] }
}
}
Record-by-Record DNS Auditing
Registrar notifications only cover changes made through that registrar, and an attacker with the account can turn them off. Domainyze asks your domain’s own authoritative nameservers from the outside, and confirms every change on a second resolver before it alerts.
Baseline snapshot
The first check records your zone, from NS and MX to A, AAAA, CNAME, TXT and CAA, as the known state. Nothing is alerted on the first sighting.
Authoritative polling
We query your domain's own authoritative nameservers on a tiered schedule, with delegation (NS/SOA) on a faster lane (hourly on Business), so a hijack is caught before any cache would show it.
Corroborated diff
We compare the live response against your known zone by record identity, then re-check any difference against a second resolver. If they disagree, nothing fires, so a glitchy resolver never becomes a false alarm.
Graded alerting
A confirmed change is sent as one alert naming each record that moved, by email or to Slack, Discord or a webhook, graded by how much it matters.
Your Nameservers Are Watched More Closely Than Anything Else
Whoever controls your nameservers controls your entire zone: the site, the mail, and the certificates. So delegation gets its own lane, checked far more often than the rest of the zone, as frequently as hourly on the Business plan.
- Asked at the source: we query your domain's own authoritative servers for NS and SOA, so a change is seen before any cache would reveal it.
- Cross-checked against your registrar: if the live nameservers disagree with the ones on record at your registrar, that mismatch is flagged on its own. It is one of the strongest early hijack signals there is.
- Its own alert: a delegation change arrives as a distinct, top-priority alert, never buried among routine record edits.
ns1.cloudflare.com · ns2.cloudflare.com
ns1.attacker-dns.xyz · ns2.attacker-dns.xyz
Live nameservers do not match the registrar's record. Possible hijack.
Critical Records You Must Monitor
Each record type controls something different, so a change to each one means something different. These are the six that matter most.
Traffic routing
Point your domain at a server’s IP address. An unexpected change can mean your site traffic is going somewhere you did not send it. Load balancers that rotate addresses are recognised and not alerted.
Mail exchange
Controls where incoming emails are sent. Attackers silently change this to intercept password resets, financial invoices, and sensitive internal communications.
Email authentication (SPF/DKIM/DMARC)
Authorises your outgoing mail. A dropped include:, a rotated DKIM selector, or a DMARC policy relaxed to p=none costs you deliverability with no error anywhere.
SPF, DKIM & DMARC monitoringNameserver authority
Decide which servers answer for your whole zone. Whoever controls them controls every other record, so NS changes are checked on their own faster lane and alerted at the highest severity.
Service mapping
Map a name to a third-party service. A changed or removed CNAME is alerted, which matters because one left pointing at a service you no longer use can be claimed by someone else.
Certificate issuance
Lists which certificate authorities may issue certificates for your domain. A change is alerted, because loosening it is a step toward a certificate you did not ask for.
Not sure what a record type does? Every one we watch is defined in the DNS records glossary. To read your records once for free, use the DNS lookup.
Built for Incident Response
A DNS change matters most in the first hour, so it goes to the tools your team already watches, and only when it is real.
Webhooks deliver each change as signed JSON that names the domain and every record that moved, so an incident platform or your own script can act on it without parsing an email.
Explore Notification ChannelsSlack & Discord
Send DNS alerts to a channel such as #devops-alerts, so the on-call engineer sees them where they already work.
Rotation Is Not Change
A record set that keeps moving, such as a load balancer’s addresses or an _acme-challenge token, is recorded but not alerted, so real changes stay visible.
One Alert per Change
Migrating a zone changes many records at once. They arrive as one alert listing each record, and a change you already heard about is not repeated. Each domain can also set the lowest severity worth an alert.
Who Watches Their DNS
An unplanned record change means something different to each of these owners. Each links to the page for that kind of owner.
Security & Legal Teams
A nameserver or MX change nobody made is how a hijack starts. It is confirmed on a second resolver before it is alerted.
Domain monitoring for security teams Use CaseOnline Stores
Checkout and order mail both depend on records you rarely look at. A changed A or MX record reaches you before a customer notices.
Domain monitoring for online stores Use CaseIT Teams & MSPs
Across dozens of client zones, the record that moved is named in the alert, so you know which client to call.
Domain monitoring for IT teams and MSPsDomainyze vs. the alternatives
How DNS change detection compares to checking records by hand and to an uptime monitor.
| Capability | Domainyze Domainyze | Manual checks | Generic uptime monitors |
|---|---|---|---|
| What is compared | Every record, by identity and value | The records you remember to look up | Whether the site responds |
| Where it asks | Your authoritative nameservers | Whatever resolver you use | The website |
| False alarms | Confirmed on a second resolver first | n/a | Retries only |
| Nameserver changes | Own faster lane, highest severity | Rarely checked | Not detected |
| Rotating records | Recognised and kept quiet | n/a | n/a |
| Change history | Every change kept, with its time | None | Uptime history only |
DNS change detection is on Pro and Business, for domains in your portfolio. Business checks both lanes more often than Pro.
This is one capability of DNS monitoring, the lane it runs in. That page covers everything else the lane watches and what each plan includes.
Start Monitoring & Catching Domains Today
Join founders, agencies, and domainers already protecting their portfolio. Your first 5 domains are free.
No credit card required • Cancel anytime
Frequently Asked Questions
How changes are detected, confirmed and delivered.
What is DNS change detection?
DNS change detection compares a domain’s live DNS records with the last known state of its zone and alerts you when a record is added, removed or changed. Domainyze asks the domain’s own authoritative nameservers, compares records by identity rather than as text, and confirms each difference on a second resolver before sending an alert.
How do I know if my DNS records were changed?
Without monitoring you usually find out from the symptoms: mail bouncing, a site not loading, a certificate failing. With DNS change detection each domain’s zone is re-read on a schedule and you receive an alert naming the record, its old value and its new value, along with a history of every earlier change.
How fast is a DNS change detected?
Nameservers and SOA are on a faster lane, checked every 6 hours on Pro and every hour on Business. The rest of the zone is checked daily on Pro and twice a day on Business. A change is caught on the next check for its lane, confirmed on a second resolver, then alerted.
Which DNS record types are monitored?
Delegation (NS, SOA), mail (MX and the SPF, DKIM and DMARC records, plus MTA-STS, TLS-RPT and BIMI), web (A, AAAA, CNAME), security (CAA, TLSA, SSHFP) and verification TXT records. Each record type is defined in the DNS records glossary.
Can DNS monitoring detect DNS hijacking?
It detects the change a hijack makes. Most hijacks work by changing nameservers or records through a compromised registrar or DNS account, and those changes are alerted, with nameserver changes on the faster lane at the highest severity. Live nameservers that disagree with the ones on record at the registry are flagged too, which is a strong early sign of tampering.
Will I be alerted every time my load balancer rotates IPs?
No. A record set that keeps changing over its recent checks, such as a rotating pool of A records, is recognised as volatile. Its changes are still recorded in the history but are not alerted. Certificate-issuance tokens under _acme-challenge are treated the same way.
Does it check DNS propagation?
No. Monitoring reads your authoritative nameservers, which is where a change starts. To see whether a change has reached public resolvers around the world, use the free DNS propagation checker.
Does it monitor SPF, DKIM and DMARC?
Yes, as part of the same zone check, and it goes further than change detection for them: it reads what each record means for your mail, such as a DMARC policy relaxed to none or two SPF records that cancel each other out. See SPF, DKIM and DMARC monitoring.
Will DNS monitoring slow down my website or nameservers?
No. Each check is a handful of standard DNS queries, the same kind every visitor’s resolver sends. It adds no measurable load to your nameservers and never touches your web server.