DNS A record change check
Lemwatch hashes your A records every hour and alerts when the IP list changes — a fast signal for hijacks, misdeploys, or accidental DNS edits.
Quick answer
Lemwatch resolves your domain's A records hourly, hashes the sorted IP list, and alerts when the hash changes vs the previous cycle.
What it checks
- All IPv4 A records for the apex and www
- Sorted-set hash so record order doesn't cause false positives
- Detects additions, removals, and swaps
- Cross-checked against 3 public resolvers to filter local anycast noise
Where to find it in Lemwatch
Site details → Health → DNS tab. Change events also surface in Activity Log with a "DNS change" pill.
How to respond
- Open the DNS tab to see old vs new IPs side-by-side.
- Confirm the change matches a planned deploy or DNS migration.
- If unplanned, check your registrar audit log for unauthorised edits.
- Add the new IPs to your CDN allowlist if you use origin protection.
- Acknowledge the alert to silence follow-ups for that IP set.
FAQ
Will this alert on healthy round-robin rotations?
No — the sorted-set hash treats [1.1.1.1, 2.2.2.2] and [2.2.2.2, 1.1.1.1] as identical.
How fast is the alert?
Within one hourly cycle. Pro plans can drop this to 15 min.
Related