Watching DNS Changes on Domains You Do Not Control
Uptime monitoring tells you when a site is down. DNS change monitoring tells you when the ground moved before anything fell over. A mail provider silently repoints MX records, a CDN migration changes A records, a partner company moves nameservers during a botched migration — none of these produce an error message, but each one changes how your integrations, mail routing and security controls behave. Watching DNS history is how you notice in hours instead of weeks.
What to track, and why each record type matters
- A / AAAA records: the site now resolves to a different datacenter, a new CDN edge, or — in the bad case — a hijacked host. Unexpected A-record drift on a domain you depend on is the single most useful early warning in this whole category.
- NS records: a nameserver move means the authoritative source of truth changed. Migration mistakes, expired delegations and registrar-level hijacks all start here.
- MX records: if your systems relay mail to a partner domain, an MX change reroutes their mail — often silently, sometimes to a provider with different spam filtering that starts rejecting your traffic.
On domains you control, this same history doubles as a change log: every record edit is timestamped, so “someone changed DNS last Thursday” has an answer even if your team’s change-management process does not.
How change detection works
The mechanism is simple and you can run it by hand for one record:
dig +short A example.com dig +short NS example.com dig +short MX example.com
A monitor repeats those queries on a schedule and compares each answer with the previous snapshot. When a value changes, the difference is stored with a timestamp and (optionally) triggers a notification. Two practical details make or break usefulness: TTL and timing. Short TTLs mean changes propagate fast, so checking every 15–30 minutes is meaningful; a domain with a 3600-second TTL changes at most once per hour anyway. And compare per record type — a service that reports “example.com changed” without saying which record type turned into noise within a week.
Why watch domains you do not own
- Vendor DNS: your SaaS tool’s endpoints moving explains mysterious integration failures before the vendor’s status page updates.
- Partner and customer domains: their MX migration is your bounces; catching it early lets you requeue instead of losing mail.
- Security intelligence: abrupt record changes on a domain you communicate with can indicate compromise — attackers repoint mail to intercept conversations, and DNS history is one of the few passive ways to spot it.
The DNS watchlist on WhoDNS implements exactly this loop for domains you choose: periodic snapshots of A, AAAA, NS and MX records, a per-record change history with timestamps, and change alerts delivered by cron, so the next silent nameserver move reaches you as a notification rather than as a Monday-morning mystery.