Monitoring

    How does Lemwatch detect DNS record changes?

    Lemwatch resolves your A, AAAA, MX, NS, CNAME, and TXT records on every check and hashes them — any hash change triggers a DNS change incident.

    Updated 2026-07-10
    1 min read
    dns
    monitoring
    change-detection

    Quick answer#

    Every scheduled check resolves A, AAAA, MX, NS, CNAME, and TXT records, sorts them, and stores a hash. When the hash changes we log the diff and open a DNS change incident.

    Why this matters#

  1. Nameserver hijacks are silent and catastrophic
  2. MX record edits break email delivery for days
  3. Rogue TXT records signal domain-shadowing attacks
  4. CNAME flips point traffic at attacker infrastructure
  5. Where to find it in Lemwatch#

    Site → DNS — history + latest snapshot.

    FAQ#

    Do you check all resolvers?#

    We query multiple resolvers (Google + Cloudflare) and flag disagreements.

  6. Change detection
  7. SSL expiry tracking
  8. Was this article helpful?