---
title: "DNS CNAME change check — Lemwatch Help"
description: "Detects when a CNAME target changes — the earliest signal of a broken CDN swap, subdomain takeover risk, or accidental alias edit."
canonical: "https://lemwatch.com/help/dns-cname-change-check"
source: "https://lemwatch.com"
---

# DNS CNAME change check

> Detects when a CNAME target changes — the earliest signal of a broken CDN swap, subdomain takeover risk, or accidental alias edit.

## Quick answer

 Lemwatch tracks the CNAME target for every subdomain you monitor and alerts on any change. If the new target resolves to nothing, we flag a potential subdomain-takeover risk.

## What it checks

- CNAME chains up to 8 hops

- Final resolved host and its A records

- Whether the target returns NXDOMAIN (takeover signal)

- Cross-region resolution to filter DNS propagation noise

## Where to find it in Lemwatch

 **Site details → Health → DNS tab.** Takeover-risk changes also raise an incident with **severity: high**.

## How to respond

- Compare old vs new target in the DNS tab.

- If new target is NXDOMAIN, remove the CNAME immediately.

- Confirm the intended vendor now owns the target.

- Re-issue TLS certs if the new host uses a different SNI.

- Acknowledge once verified.

## FAQ

### What is a subdomain takeover?

 An attacker claims an abandoned CNAME target (e.g. an old Heroku app) and serves content under your domain.

### Does this cover ALIAS/ANAME too?

 Yes — resolved through the same path.

## Related

- DNS A record change check

- DNS diagnostics

- Bypassing bot protection


## Related

- [Help centre](https://lemwatch.com/help)
- [DNS A record change check](https://lemwatch.com/help/dns-a-record-change-check)
- [DNS Diagnostics](https://lemwatch.com/help/dns-diagnostics)
- [Bypassing bot protection for Lemwatch checks](https://lemwatch.com/help/bypassing-bot-protection)
- [DNS MX record check](https://lemwatch.com/help/dns-mx-record-check)
- [DNS NS record check](https://lemwatch.com/help/dns-ns-record-check)
- [Lemwatch pricing](https://lemwatch.com/pricing)
- [How does Lemwatch detect DNS record changes?](https://lemwatch.com/help/dns-change-monitoring)