On this page
When Domainyze detects changes to your domain's DNS records, you'll receive detailed alerts via email and webhook (if configured). This guide helps you understand what these alerts mean and how to respond.
What Triggers a DNS Change Alert?
A DNS change alert is triggered when a record is added, removed, or changed, and the change is confirmed by a second resolver. A one-off resolver glitch that a second resolver does not see is not alerted.
Depending on what changed, you receive one of three kinds of alert, so the important events do not get buried in ordinary churn:
- Nameserver delegation changed: your NS or SOA records moved. This is the highest-priority DNS alert; an unexpected one can mean a hijack.
- Email authentication changed: an SPF, DKIM, DMARC, or MX record moved. See SPF, DKIM & DMARC monitoring.
- DNS records modified: any other record change (website A/AAAA, CAA, verification TXT, and so on).
Note: The initial DNS check when you first add a domain does not trigger alerts; it establishes your baseline. Only subsequent changes are reported.
How Severity Is Decided
Every change is graded before it is sent, and the grade depends on which part of the zone changed and what happened to it. Losing a record is almost always more serious than gaining one, and the same edit is graded differently on your nameservers than on a verification token.
| Level | What it covers |
|---|---|
| Critical | Any nameserver or SOA change, and any mail record that is edited or disappears. These are the changes that can redirect a domain or stop its email. |
| High | A certificate authority (CAA) record edited or removed, and a website address removed. |
| Medium | A website address edited. |
| Informational | New records appearing on the parts of the zone that are not load-bearing, and anything on records we classify as "other". |
The grade is resolved and stored when the change is detected, so retuning the grading later never rewrites what you were told last month.
You can set a minimum severity per domain, under DNS Alerts → Configure on the domain page. The setting names what it would still alert you on, so you can see what a floor costs before choosing it. Changes below your floor are still recorded on the domain and visible in its DNS history; they are simply not sent.
Repeated and Flapping Changes
If the same change keeps recurring (a load balancer reshuffling the same set of IP addresses every check, say), Domainyze suppresses the repeats for a while rather than emailing you nightly, and tells you how many similar changes were rolled up. A different change is never suppressed by an earlier one: a genuine new problem always alerts immediately.
Alert Notification Channels
DNS change alerts are sent through:
- Email: Sent to your account email address
- Webhook: Posted to your configured webhook URL (if enabled)
Learn more about configuring notifications in Email & Webhook Integrations.
What Information Is Included?
Each DNS change alert contains:
- Domain Name: The affected domain
- Timestamp: When the change was detected
- Changed Record Types: Which DNS record types were affected (e.g., A, MX, NS)
- Added Records: Specific records that were added
- Removed Records: Specific records that were removed
- View Domain Link: Direct link to view full details in your Portfolio
Email Alert Example
Subject: DNS Changes Detected: example.com
DNS record changes have been detected for example.com.
Changed record types: A, MX
**A Added:** 192.0.2.100
**A Removed:** 192.0.2.50
**MX Added:** 20 mail2.example.com.
**MX Removed:** 10 mail1.example.com.
[View Domain] → /portfolio/example.com
Please review these changes to ensure they are expected.
What each kind of change means, with worked examples
The same three markers (added, removed, changed) mean very different things depending on where in the zone they appear. These are the changes you will actually see, what each implies, and when to worry.
Nameserver (NS) changes
NS Removed: ns1.oldprovider.com.
NS Added: ns1.newprovider.com.
What it means: the authoritative nameservers for your domain moved, which hands the entire zone to whoever runs the new servers.
Normal when you switched DNS provider, registrar or host, or enabled a CDN such as Cloudflare that takes over your DNS.
How we flag it: a dedicated delegation change alert, the highest-priority DNS alert, caught on the fast delegation lane rather than waiting for a full zone check. If the new nameservers also disagree with the ones your registrar has on record, we raise a registry mismatch finding, which is a strong hijack signal on its own.
If it was not you: treat it as an incident. Change your registrar password, enable two-factor authentication, review the account's access log, contact registrar support and lock the domain.
MX and email-authentication changes
MX Removed: 10 mail.oldmail.com.
MX Added: 10 mx1.newmail.com.
TXT Removed: v=spf1 include:_spf.oldmail.com ~all
TXT Added: v=spf1 include:_spf.newmail.com ~all
What it means: where your mail is delivered, or how it is authenticated, has changed.
Normal when you changed email provider or reconfigured sending infrastructure. After a deliberate change, test sending and receiving, and confirm SPF, DKIM and DMARC all still align.
How we flag it: a dedicated email authentication changed alert with old and new values, plus a posture grade on the Mail card. This is why a policy quietly relaxed from p=reject to p=none, or an SPF record that loses an include:, stands out instead of blending into ordinary churn. A p=quarantine DMARC record appearing for the first time is the same alert read the other way: someone tightened your email security.
If it was not you: this is the classic silent hijack. Attackers redirect mail to intercept password resets while leaving the website up, so nobody notices for weeks.
A and AAAA record changes
A Removed: 192.0.2.50
A Added: 192.0.2.100
What it means: where your website is hosted has changed. Several A records appearing at once is usually load balancing; an entirely new address range often means a CDN went in front of the site.
Normal when you migrated host, moved servers, added a CDN or scaled out. A first AAAA record simply means IPv6 was enabled.
After a deliberate change, confirm the site loads and the certificate is valid at the new address.
CAA changes
CAA Added: 0 issue "letsencrypt.org"
What it means: which certificate authorities are permitted to issue certificates for your domain. Adding CAA records is a security improvement; removing them widens who may issue.
Normal when you tightened certificate controls or changed SSL provider. Check the authority you actually use is still listed, or future renewals will fail.
CNAME and subdomain changes
CNAME Added: www.example.com points to example.com.
What it means: a name now aliases somewhere else. Routine for www and service subdomains.
Worth a second look when the target is a third-party service nobody remembers adding. A CNAME pointing at a service that has since been shut down can be claimed by somebody else, who then controls that subdomain.
How to respond to an alert
- Read what actually changed. The alert carries the old and new values, not just the record type.
- Ask whether it was authorised by your team, host or DNS provider. Most alerts resolve here.
- Check your DNS provider's audit log for who made the change and when.
- If it was not authorised, treat it as a security incident: reset the account password, enable two-factor authentication, review access logs, and contact the provider. For a nameserver change, contact your registrar rather than your DNS host.
Take immediate action if nameservers moved to a provider you do not recognise, if several record types changed at once with no explanation, or if mail or the website stopped working right after the change.
Reducing expected noise
Some changes are routine for you and not worth an alert every time: an actively developed site whose A record moves on every deploy, or a load balancer reshuffling the same addresses.
- Exclude the record types you edit routinely, per domain, keeping
NS,MX,SPF,DKIM,DMARCandCAA. That removes nearly all the noise while keeping every record type a hijack would touch. - Set a minimum severity per domain, as described above.
- Keep a change log so a real alert can be matched against planned work quickly.
See How to customize alert frequency for every control.
Full history
Every check is recorded, whether or not anything changed. Open the domain from your Portfolio and go to DNS Check History for the complete timeline. See Viewing DNS check history for what is stored and for how long.
Need help?
If you are unsure about an alert, review the domain's DNS history, check with whoever administers your DNS, and contact your registrar immediately if you suspect a hijack.