Question 1

What is DNS monitoring?

Accepted Answer

DNS monitoring is the continuous automated tracking of a domain's DNS records to detect changes, misconfigurations, or hijacking attempts. A DNS monitor queries authoritative name servers for each configured record type (A, AAAA, CNAME, MX, NS, TXT, CAA) on a regular schedule and compares the current values against a stored baseline. Any change triggers an alert that includes the record type, the old value, the new value, and the time of the change. DNS monitoring is distinct from uptime monitoring: an uptime monitor asks "is the server responding?" while a DNS monitor asks "is traffic still going to the right server?" — two different failure modes that require two different checks.

Question 2

Why are DNS changes dangerous?

Accepted Answer

DNS is the internet's directory service — it translates domain names into the IP addresses that actually route traffic. Every visit to a website, every email sent to a domain, and every API call from a mobile app starts with a DNS lookup. If an attacker changes your A or AAAA record, visitors go to their server instead of yours and see whatever phishing page they put up. If they change your MX records, your incoming email is delivered to their mail server instead of yours — including password resets and 2FA codes. If they change your NS records, they control every other record automatically. DNS hijacking is uniquely dangerous because it leaves your origin server untouched: anything that only monitors the origin (uptime, load, status codes) shows everything as perfectly fine while every actual user is being silently redirected.

Question 3

How does DNS hijacking happen?

Accepted Answer

The common attack vectors, in rough order of frequency: a compromised registrar account (weak password, no 2FA, phished credentials, SIM-swap on the associated phone number); social-engineering registrar support staff into transferring control; exploiting a vulnerability in the registrar control panel or the DNS hosting provider; BGP hijacking of the path to an authoritative name server (the 2018 MyEtherWallet attack used this technique to steal ~$150K in Ethereum); compromised internal tooling that has registrar API access; and a disgruntled or compromised employee making changes directly. Accidental changes by the operations team are also a significant source of outages — monitoring catches both malicious and accidental modifications with the same mechanism.

Question 4

How quickly does upsonar detect DNS changes?

Accepted Answer

Upsonar queries your DNS records on every monitoring cycle — 1 minute on Pulse/Wave plans, 5 minutes on the free Echo plan. When a change is detected, you receive an alert within seconds through every configured channel (email, Telegram, Slack webhook, custom webhook). The alert shows exactly which record changed, the old value, the new value, and the time of the first check that observed the change. For the most sensitive records (NS, MX, CAA) Upsonar recommends enabling separate alerts so they cut through any noise from routine A/AAAA changes.

Question 5

What is DNS propagation?

Accepted Answer

DNS propagation is the interval between the moment a DNS record is updated at the authoritative name server and the moment every DNS resolver on the internet sees the new value. It typically takes 1-48 hours depending on the record's TTL (time-to-live) setting. During propagation, some users query resolvers that still have the old value cached and get the old IP, while others query resolvers that have fetched the fresh value and get the new IP. Setting TTLs to a low value (60-300 seconds) before planned changes speeds propagation at the cost of more queries hitting your name servers. DNS monitoring helps during propagation because you can see, per-region, whether the new value has actually reached each monitoring location.

Question 6

What DNS record types should I monitor?

Accepted Answer

At minimum: A and AAAA (where your website actually lives), NS (delegation — whoever controls NS controls everything), and MX (email delivery). If you use custom email authentication, monitor the TXT records that hold SPF, DKIM, and DMARC policies — changes to these silently break deliverability. If you use a certificate authority that checks CAA records (which is most of them since 2017), monitor CAA so a silent change cannot let a rogue CA issue a certificate for your domain. Upsonar monitors all of these on every plan, with per-record alerting.

Question 7

Does DNS monitoring prevent attacks?

Accepted Answer

No — DNS monitoring is a detection tool, not a prevention tool. It cannot stop an attacker from changing your DNS records. What it can do is cut the time-to-detection from days or weeks to minutes. Without monitoring, a DNS hijack is typically discovered only when users or customer support notice something wrong, which in real-world incidents has meant anywhere from 6 hours to 2 weeks of silent exposure. With monitoring, you are alerted within minutes of the first query that observes the change, giving you time to revoke the compromised registrar credentials, contact your registrar's emergency support, roll back the records, and assess the damage.

Free DNS Monitoring

What is DNS monitoring?

Why DNS Monitoring Matters

DNS Hijacking

Silent Changes

Instant Detection

How DNS Monitoring Works

What We Monitor

Check Your Domain's DNS Records

Related

Frequently Asked Questions

Protect Your DNS Records