DNS knowledge pillar
DNS Security and Monitoring Guide
DNS security and monitoring protect the records that connect domains to websites, APIs, email, and other services by tracking expected answers, delegation, integrity controls, and meaningful changes.
What does DNS monitoring check?
DNS monitoring verifies that critical names resolve, expected record values remain present, authoritative servers answer, delegation is intact, and response behavior is consistent from relevant locations. Good monitoring distinguishes a deliberate change from an outage and records enough evidence for rollback.
What are A and AAAA records?
A records map names to IPv4 addresses. AAAA records map names to IPv6 addresses. Applications can publish both, and clients may prefer IPv6 when it is available. Teams should test both paths because a broken AAAA record can affect only part of the user population.
What is a CNAME record?
A CNAME makes one name an alias of another name. It is useful for vendor and platform integrations, but stale targets and long chains create operational risk. The alias owner generally cannot publish unrelated record types at the same name.
What are MX, TXT, and NS records?
MX records identify mail exchangers. TXT records carry arbitrary text used by systems including SPF, DKIM, DMARC, and domain verification. NS records identify authoritative nameservers for a zone or delegation. Each type has different validation and monitoring requirements.
What is DNS TTL?
TTL controls how long recursive resolvers may cache an answer. It balances cache efficiency with change speed. Lowering TTL before a migration can reduce the persistence of old answers, but only after existing caches have aged out.
What is DNSSEC?
DNSSEC adds signatures that let validating resolvers confirm DNS data came from the expected signed zone and was not modified in transit. It does not encrypt queries. Incorrect DS, DNSKEY, signature, or rollover handling can cause validating clients to receive SERVFAIL.
How do SPF, DKIM, and DMARC use DNS?
SPF publishes which systems may send mail for a domain. DKIM publishes public keys used to verify message signatures. DMARC publishes alignment and policy instructions for messages using the domain. Monitoring should verify syntax, target names, key availability, and intentional policy changes.
What causes DNS security incidents?
Common causes include registrar compromise, unauthorized record changes, stale vendor mappings, exposed provider credentials, DNSSEC errors, subdomain takeover conditions, and accidental deletion. Strong registrar security, least privilege, change review, and external monitoring reduce detection time.
How should teams respond to unexpected DNS changes?
Capture the observed answer and timestamp, query authoritative servers directly, review provider audit logs, confirm the intended change with the owner, and restore the approved value if unauthorized. Consider cache lifetime when estimating recovery.
What does a technical example look like?
example.com. 300 IN A 203.0.113.10
www.example.com. 300 IN CNAME app.vendor.example.
example.com. 3600 IN MX 10 mail.example.com.
example.com. 3600 IN TXT "v=spf1 include:_spf.example.net -all"
_dmarc.example.com. 3600 IN TXT "v=DMARC1; p=reject"The example uses reserved documentation domains and addresses. Apply the same reasoning to systems you own or are authorized to assess.
Authoritative technical references
How does continuous monitoring help?
A point-in-time check explains the observed state now. Continuous monitoring establishes an expected baseline, repeats the relevant check, and records meaningful state changes so an owner can investigate before a small configuration drift becomes a prolonged security or availability problem. See Learn for the surrounding technical context.
Where does Sentryx Monitor fit?
Sentryx Monitor provides read-only outside-in discovery and monitoring for public hosts, DNS, HTTPS, TLS certificates, baseline security headers, email-security records, and selected network services. It supports evidence and operational follow-up, but it does not replace authorized penetration testing, authenticated vulnerability assessment, or owner validation.