DNS monitoring
DNS monitoring that tells you when records move.
DNS monitoring records every change to your domains’ DNS and can email you when nameserver, web or mail records move. You find out from Aepto, not from customers whose email bounced.
What is DNS monitoring, and what does it catch?
DNS monitoring checks your domains' DNS records on a schedule, keeps a history of every change, and alerts you when something moves. It catches:
- Nameservers moved to a provider you don't use, the classic sign of a domain hijack.
- Web records (A, AAAA, CNAME) pointing your site at the wrong server.
- Mail records (MX) changed, so inbound email bounces or goes elsewhere.
- SPF, DKIM or DMARC removed, so outbound mail starts landing in spam.
- A contractor's "cleanup" that deleted records during a migration.
- Records that changed when a DNS host or registrar account was taken over.
What are the four DNS monitoring modes?
Choose a mode per domain. Quiet history for parked names, emails for the ones that earn money.
| Mode | What you get | Uses AI credits? |
|---|---|---|
| Off | No history and no emails | No |
| History only | Every change is logged in Aepto. Click Analyze on a row when you want an explanation | Only when you click Analyze |
| Email on every change | A plain-facts email for each change | No |
| Email only if risky | An email when a change looks risky, with an AI explanation when your plan has credits | Yes, for the explanation |
Which DNS records should you watch, and why?
Each record type protects a different part of the business.
| Record | Protects | Watch for |
|---|---|---|
| NS | Control of the whole zone | Any change you did not plan. Treat it as a possible takeover |
| A, AAAA, CNAME | Your website and apps | Moves to unknown hosts or IP ranges |
| MX | Inbound email | New mail servers you did not set up |
| TXT (SPF, DKIM, DMARC) | Outbound email delivery | Removed or loosened records. Gmail requires SPF or DKIM for all senders, plus DMARC above 5,000 messages a day |
| CAA | Who may issue your TLS certificates | Added or removed certificate authorities |
Gmail sender rules: Google Workspace Admin Help.
How is DNS monitoring different from Theft Guard?
They overlap on purpose. One keeps the record detail, the other watches for takeover-style moves.
| Question | DNS monitoring | Theft Guard |
|---|---|---|
| Watches | DNS records: NS, A, MX, TXT and more | Registrar, nameservers and related security signals against a baseline |
| You get | Change history and optional emails | Alerts in Requires Your Attention and emails to Theft Guard contacts |
| Best for | Record-level detail and mail health | Hijacks and unexpected registrar or nameserver moves |
| After a planned change | Nothing to do. The history shows it | Click Update Baseline so the new state counts as normal |
How do you set up DNS monitoring?
A few minutes per domain, or one pass across the whole portfolio.
- 01
Turn it on
Flip the DNS switch on a domain card, or open Domains, then DNS monitoring.
- 02
Pick a mode
History only, every change, or risky changes only.
- 03
Choose who hears about it
Emails go to your account email, or to alert contacts with the DNS notification type on paid plans.
- 04
Review the history
Each change shows old and new values with a timestamp. Run Analyze when you need context.
What should you do when a change looks wrong?
Check it from a second network, then revert at your DNS host if nobody planned it. The guide what happens when someone changes your DNS walks through the first hours, and if your domain is stolen covers the registrar side.
Common questions
Short answers to what people ask before they start.
What is DNS monitoring?
DNS monitoring checks the DNS records of your domains on a schedule, records every change, and alerts you when records move. It catches mistakes, expired setups and hijacks before customers or mail servers do.
Is DNS monitoring included on the Free plan?
Yes. DNS change history is available on every plan, including Free for 3 domains. AI explanations of risky changes use AI credits, and Free includes 50 credits a month.
Does it work with any DNS host or registrar?
Yes. Aepto reads your domains' public DNS, so it works wherever your DNS is hosted. Nothing has to be transferred.
Can Aepto change or fix my DNS records?
No. Aepto records and alerts. You fix records at your DNS host or registrar, using the history to see what changed and when.
How is DNS monitoring different from Theft Guard?
DNS monitoring keeps record-level history and change emails. Theft Guard watches domain-level security signals such as registrar and nameserver moves against a baseline. Most portfolios run both.
See every DNS change across your domains.
Free for 3 domains. History on every plan.
