Monitoring

    DNS NS record check

    Alerts when authoritative nameservers change — the fastest warning of a domain hijack or unauthorised registrar transfer.

    Part of DNS monitoring — the full answer, the facts and the alternatives in one place.

    Updated 2026-07-10
    1 min read
    dns
    ns
    nameservers

    Quick answer#

    Lemwatch tracks the authoritative NS set at the registry (via the parent zone) and alerts on any change — always severity: critical.

    What it checks#

  1. NS records from the TLD registry, not the child zone (harder to spoof)
  2. Sorted-set hash of nameserver hosts
  3. DNSSEC DS record presence
  4. Registrar of record (via RDAP)

    5. Where to find it in Lemwatch#

    Site details → Health → DNS tab.

    How to respond#

  5. Log into your registrar and check the audit trail.
  6. If the change is unauthorised, lock the domain and contact your registrar.
  7. If planned, acknowledge the alert.
  8. Consider enabling registrar lock (clientTransferProhibited).

    9. FAQ#

    Why is this severity always critical?#

    NS changes usually mean either a planned migration or an active hijack — both need eyes-on.

    Does DNSSEC help?#

    Yes — Lemwatch also alerts if DS records disappear.

    Related#

  9. DNS A record change check
  10. Whois & domain expiry check
  11. Renewals & SSL management
    12. Was this article helpful?

    Previous

    DNS MX record check

    Next

    Whois & domain expiry check

    Related Articles

    DNS A record change check

    Lemwatch hashes your A records every hour and alerts when the IP list changes — a fast signal for hijacks, misdeploys, or accidental DNS edits.

    Whois & domain expiry check

    Uses RDAP to track domain expiry, auto-renew status, and registrar lock — alerts you 90, 30, 14, and 3 days before expiry.

    SSL & Domain Renewals

    Track SSL certificate and domain expiry dates to avoid service interruptions.

    How does Lemwatch track SSL certificate expiry?

    Lemwatch reads the TLS certificate on every uptime check and starts alerting 30, 14, 7, and 1 day before expiry so you never ship an expired cert.

    Back to Help Center