DNS Monitoring Guide: Which Records to Watch and How to Detect Changes

The records that actually matter

• A / AAAA (apex + www): where your traffic goes. An unexpected change is either an outage or a hijack — both page-worthy.
• NS + SOA: who is authoritative. NS changes mean control of the zone moved; a jumping SOA serial means someone is editing the zone.
• MX + SPF / DKIM / DMARC TXT: your email deliverability and anti-spoofing posture. A vendor onboarding that pushes SPF over the 10-lookup limit silently breaks mail.
• CAA: which CAs may issue for your domain. Drift here can fail your next renewal at 2am — and signals someone preparing a rogue issuance.
• CNAME: watch for dangling CNAMEs pointing at deprovisioned services (subdomain takeover) after migrations.

Baseline first, then diff

Grab the current truth with dig before you monitor anything — without a baseline, change detection is impossible:

for t in A AAAA NS MX TXT CAA SOA; do echo "== $t =="; dig +short yourdomain.com $t; done
dig +short www.yourdomain.com A
dig +short _dmarc.yourdomain.com TXT

Save that output. Every future check is a diff against it: same values = quiet, any delta = alert with old vs. new shown side by side. That diff habit is what separates monitoring from uptime pinging.

Alert tiers that survive on-call

• Page immediately: NS change, apex A/AAAA change, MX change — traffic or mail is moving.
• Ticket next morning: SPF/DMARC/CAA drift, new verification TXT records, TTL-only changes.
• Mute during planned work: suppress the watched set for the duration of a migration ticket, or every deploy pages you.

Real campaigns this catches — from registrar compromise to cache poisoning — are documented in DNS hijacking: real-world attacks.

Automate the diff

Certack snapshots A, AAAA, CNAME, MX, TXT, and NS records daily and alerts on any drift with full before/after state — alongside SSL expiry and domain expiry in one dashboard. Start with two sites free.