Monitoring

    DNS CNAME change check

    Detects when a CNAME target changes — the earliest signal of a broken CDN swap, subdomain takeover risk, or accidental alias edit.

    Part of DNS monitoring — the full answer, the facts and the alternatives in one place.

    Updated 2026-07-10
    1 min read
    dns
    cname
    takeover

    Quick answer#

    Lemwatch tracks the CNAME target for every subdomain you monitor and alerts on any change. If the new target resolves to nothing, we flag a potential subdomain-takeover risk.

    What it checks#

  1. CNAME chains up to 8 hops
  2. Final resolved host and its A records
  3. Whether the target returns NXDOMAIN (takeover signal)
  4. Cross-region resolution to filter DNS propagation noise

    5. Where to find it in Lemwatch#

    Site details → Health → DNS tab. Takeover-risk changes also raise an incident with severity: high.

    How to respond#

  5. Compare old vs new target in the DNS tab.
  6. If new target is NXDOMAIN, remove the CNAME immediately.
  7. Confirm the intended vendor now owns the target.
  8. Re-issue TLS certs if the new host uses a different SNI.
  9. Acknowledge once verified.

    10. FAQ#

    What is a subdomain takeover?#

    An attacker claims an abandoned CNAME target (e.g. an old Heroku app) and serves content under your domain.

    Does this cover ALIAS/ANAME too?#

    Yes — resolved through the same path.

    Related#

  10. DNS A record change check
  11. DNS diagnostics
  12. Bypassing bot protection
    13. Was this article helpful?

    Previous

    DNS A record change check

    Next

    DNS MX record check

    Related Articles

    DNS A record change check

    Lemwatch hashes your A records every hour and alerts when the IP list changes — a fast signal for hijacks, misdeploys, or accidental DNS edits.

    DNS Diagnostics

    Monitor DNS records, email authentication, and detect DNS changes.

    Bypassing bot protection for Lemwatch checks

    Configure bot-management platforms (Cloudflare, DataDome, PerimeterX, Akamai) so Lemwatch checks succeed without weakening security.

    Whois & domain expiry check

    Uses RDAP to track domain expiry, auto-renew status, and registrar lock — alerts you 90, 30, 14, and 3 days before expiry.

    Back to Help Center