DNS is the phone book of the internet. If someone changes your A, CNAME or NS records without permission, traffic can be redirected, email can be stolen, and your real server can look fine while customers never reach it.
Common DNS risks
- Compromised registrar account — Attacker changes nameservers entirely
- Stale API keys — Cloud DNS providers accessed with leaked credentials
- Human error — Wrong record pasted during a migration
- Email disruption — MX record changed or removed
Signs something changed
Compare current public DNS answers to a known-good baseline. Monitor at least:
- A and AAAA records for your apex and
www - CNAME chains for CDNs and SaaS tools
- MX records for mail delivery
- NS records if you self-manage DNS
Why internal tools are not enough
Your web server logs show requests that arrived. They do not show requests that were sent elsewhere because DNS pointed to the wrong IP. Only external DNS lookups reveal what the world actually sees.
Practical steps
- Run a free DNS lookup today and save the results.
- Enable DNS change alerts on your domain monitor.
- Lock down registrar accounts with 2FA and role-based access.
UpMonix domain monitors compare DNS over time and alert when critical records drift from the baseline you confirmed.