DNS and domain monitoring detects changes or risks affecting the infrastructure that directs users to a website. DNS monitoring watches important records and configuration, while domain monitoring tracks registration, expiry and important status changes.
A website can be healthy at the server level but unavailable because its DNS points to the wrong destination or its domain registration has lapsed. These dependencies need ownership, monitoring and tested response procedures.
Key takeaways
- DNS and domain registration are different operational layers.
- Monitor the records that support critical web and email services.
- Record registrar, renewal and payment ownership for every domain.
- Treat unexpected DNS changes as events requiring review.
- Do not rely only on auto-renewal or registrar reminder emails.
- Review DNS and domain inventories during every migration.
What is DNS monitoring?
DNS monitoring checks whether important DNS records and configuration match the expected state.
DNS translates names such as app.example.com into information that clients use to find services. A change can affect websites, APIs, email delivery, certificate validation and third-party integrations.
A DNS monitor may track:
- Record presence.
- Record value.
- Nameservers.
- Changes over time.
- Resolution behaviour.
- Misconfiguration.
- Propagation or inconsistency.
The monitoring policy should focus on operationally important records rather than alerting on every harmless update.
What is domain monitoring?
Domain monitoring tracks registration information, expiry and important status changes.
A production domain record should include:
- Registrar.
- Registrant organisation.
- Administrative owner.
- Expiry date.
- Auto-renewal state.
- Payment owner.
- Nameservers.
- Transfer lock.
- Recovery contact.
- Client or business owner.
A domain can affect website access, API endpoints, email and brand trust. Ownership should never depend on one employee’s personal account.
How do DNS and domain monitoring differ?
| DNS monitoring | Domain monitoring |
|---|---|
| Checks records used to route services | Checks registration and status |
| Detects changed or missing records | Detects expiry and registrar changes |
| Affects web, email and integrations | Affects control of the domain itself |
| Managed through a DNS provider | Managed through a registrar |
| Changes may propagate over time | Renewal and transfer follow registrar rules |
Many organisations use the same supplier for both, but the responsibilities remain different.
Which DNS records should be monitored?
Monitor records whose failure would affect a critical service.
A and AAAA records
These direct names to IPv4 and IPv6 addresses. Unexpected changes can send traffic to the wrong server.
CNAME records
These alias one name to another service. They are common with hosted applications, CDNs and verification services.
MX records
These control email routing. Incorrect changes can stop incoming mail or redirect it.
TXT records
These support domain verification, email security and service configuration. Not every TXT change is critical, so select important records.
NS records
These identify authoritative nameservers. Unexpected changes can affect control of the DNS zone.
CAA records
These restrict which certificate authorities may issue certificates for the domain. Incorrect configuration can disrupt certificate issuance.
What causes DNS failures?
Common causes include:
- Incorrect migration values.
- Deleted records.
- Typographical errors.
- Wrong TTL expectations.
- Expired hosted service.
- Nameserver change.
- Account compromise.
- Conflicting records.
- Partial update across providers.
- Misunderstood proxy or CDN settings.
- Automation overwriting manual configuration.
Record the intended state and change process so the team can distinguish approved work from unexpected behaviour.
What is DNS propagation?
DNS resolvers cache records according to their time-to-live and their own behaviour. After a planned change, different users may temporarily receive old and new values.
Propagation is not the same as a DNS outage.
Before a migration:
- Record the current state.
- Reduce TTL in advance where appropriate.
- Prepare the destination.
- Make the change.
- Validate from independent resolvers.
- Monitor both application behaviour and DNS.
- Restore normal TTL when stable.
Do not use “propagation” as a generic explanation for every post-change failure. Check the actual authoritative and resolved records.
How can unexpected DNS changes be detected?
A monitoring system can compare observed values with a known or previous state.
When an unexpected change appears:
- Confirm the authoritative nameservers.
- Review recent planned work.
- Identify who changed the record.
- Check registrar and DNS-provider account activity.
- Evaluate customer impact.
- Restore the approved value where authorised.
- Rotate credentials if compromise is suspected.
- Review account access and change controls.
Treat nameserver changes as high priority because they can alter the entire zone.
What happens when a domain expires?
Domain-expiry behaviour varies by registry, registrar and top-level domain.
Possible stages include:
- Renewal reminders.
- Expiry.
- Service interruption.
- Grace period.
- Redemption or recovery period.
- Release for registration.
Do not assume the same timeline applies to every domain. The safest approach is to renew well before expiry and confirm payment and ownership.
Read What happens when a domain expires?.
Why can domain auto-renewal fail?
Possible causes include:
- Expired payment card.
- Billing failure.
- Account lock.
- Renewal disabled.
- Incorrect contact details.
- Domain transferred to another account.
- Registrar policy.
- Internal ownership confusion.
- Procurement delay.
- Fraud or security review.
Independent monitoring should notify both the technical owner and the person able to resolve payment or account issues.
How should domains be managed across multiple registrars?
Centralise the inventory even when registration remains distributed.
Recommended fields:
| Field | Purpose |
|---|---|
| Domain | Exact production asset |
| Registrar | Where it is controlled |
| Account owner | Organisation or team |
| Expiry | Renewal deadline |
| Auto-renew | Current state |
| Payment owner | Person or function responsible |
| Nameservers | DNS delegation |
| Client/business owner | Final authority |
| Transfer lock | Protection state |
| Notes | Migration or contract context |
Review the register at least quarterly and during employee, client or supplier transitions.
How should agencies manage client domains?
Agencies should establish whether they:
- Own the registrar account.
- Manage it on behalf of the client.
- Only monitor it.
- Have authority to renew.
- Have authority to change DNS.
- Are included in expiry notifications.
- Are responsible under the maintenance agreement.
Where possible, the client organisation should remain the legal registrant rather than an individual employee or supplier.
Monitoring can detect risk, but the agreement must define who is authorised to act.
How should SaaS teams manage production domains?
A SaaS team should identify all domains used for:
- Marketing.
- Application.
- API.
- Authentication.
- Email.
- Webhooks.
- Documentation.
- Status communication.
- Redirects.
- Customer-specific or white-labelled services.
Legacy and redirect domains can remain business-critical because customers, integrations or search engines still use them.
How do DNS, SSL and domain incidents interact?
These layers are connected.
Examples:
- A domain expiry breaks DNS resolution and secure access.
- A nameserver change removes certificate-validation records.
- A DNS migration points to a server with the wrong certificate.
- A CAA change prevents certificate renewal.
- A CDN change alters both DNS and certificate behaviour.
Investigate related layers rather than treating each alert in isolation.
What should a DNS or domain alert contain?
Include:
- Domain.
- Record or status that changed.
- Previous value.
- New value.
- Detection time.
- Expected state.
- Named owner.
- Link to the registrar or DNS runbook.
- Whether customer impact is confirmed.
Never include registrar passwords or sensitive recovery details in the alert.
DNS and domain monitoring checklist
Inventory
- All production domains listed.
- Registrars recorded.
- DNS providers recorded.
- Registrant organisations confirmed.
- Renewal owners assigned.
- Payment owners assigned.
- Nameservers recorded.
- Legacy and redirect domains included.
Monitoring
- A and AAAA records monitored where critical.
- Important CNAME records monitored.
- MX and email-security records reviewed.
- NS records monitored.
- Domain expiry monitored.
- Registrar and ownership changes reviewed.
- Alert contacts tested.
Governance
- Multi-factor authentication enabled at suppliers.
- Shared organisational ownership used.
- Personal accounts avoided.
- Transfer locks reviewed.
- Recovery contacts current.
- Change process documented.
- Inventory reviewed during migrations.
Frequently asked questions
Is DNS hosting the same as domain registration?
No. The registrar manages domain registration. The DNS provider hosts the records used to route services. One company may provide both.
How often should DNS be monitored?
Critical records can be checked frequently enough to detect unexpected changes quickly. The exact interval depends on business impact, expected change frequency and platform capability.
Can DNS monitoring prevent a change?
Usually it detects the observed change. Prevention requires supplier access controls, multi-factor authentication, change approval and secure account management.
Does auto-renewal guarantee a domain will renew?
No. Billing, account and policy problems can still cause failure. Track expiry independently and assign ownership.
What domain changes does Sentinel monitor?
Sentinel states that it monitors WHOIS data and domain records for registrar changes, expiry risks and ownership modifications.
Does Sentinel monitor DNS propagation?
Sentinel’s homepage states that its DNS audits detect inconsistencies, propagation delays and misconfigurations.
Protect the infrastructure behind the website
DNS and domains are quiet dependencies until something changes. Maintain a complete inventory, monitor important records and status, and give every alert an owner who can act.
Track DNS configuration and domain risk alongside uptime and SSL.
Review current options on the Sentinel pricing page.