Which DNS Records Should Be Monitored?

Part of the DNS and Domain Monitoring guide.

Direct answer

The DNS records worth monitoring are the ones a business actually depends on to be reachable: A/AAAA records pointing to the website’s server, CNAME records for subdomains and third-party services, MX records for email delivery, TXT records used for email authentication (SPF, DKIM, DMARC) and domain verification, and NS records specifying the authoritative nameservers. Each controls a distinct part of the site or business, and each can fail independently of the others.

Key takeaways

• Not every DNS record carries equal risk – prioritise the ones tied to revenue, email and core services.
• MX and TXT records are frequently overlooked despite controlling something as critical as email delivery.
• Monitoring should flag both failure to resolve and unexpected changes to a record’s value.
• NS record changes affect the entire domain, not just one record, and deserve the highest priority.

A and AAAA records

A and AAAA records point a domain or subdomain directly to a server’s IPv4 or IPv6 address. If this record is wrong, missing, or points to a decommissioned server – a common outcome of an unfinished migration – the website becomes completely unreachable. This is the most fundamental record to monitor for any domain serving a website.

CNAME records

CNAME records alias a subdomain to another hostname, commonly used for services like a documentation platform, a CDN, a help desk or an app subdomain hosted elsewhere. A CNAME left pointing at a decommissioned or expired third-party service is a frequent cause of a specific subdomain breaking while the main site continues working normally, which makes it easy to miss without dedicated monitoring.

MX records

MX records direct where email for the domain is delivered. An incorrect or missing MX record doesn’t produce a visible website error – it silently stops inbound email from being delivered, which can go unnoticed for days if nobody is actively expecting mail. Given how disruptive silent email loss is to a business, MX records warrant the same monitoring priority as the website itself.

TXT records (SPF, DKIM, DMARC)

TXT records serve several purposes, most critically email authentication. SPF, DKIM and DMARC records tell receiving mail servers whether an email claiming to be from the domain is legitimate; if these break, outbound email can start landing in spam or being rejected outright, even though nothing about the mail server itself has changed. TXT records are also commonly used for domain ownership verification with third-party services, so an unexpected change can also break an integration.

NS records

NS records specify which nameservers are authoritative for the domain. A change here affects every other record at once, since it redirects the entire domain’s DNS resolution to a different provider. An incorrect or unintentional NS change is one of the highest-impact DNS failures possible, because it isn’t limited to one service – it can take down the website, email and any other DNS-dependent service simultaneously.

Monitoring priority at a glance

Original Sentinel evidence

Frequently asked questions

Should every subdomain’s DNS records be monitored individually?
Any subdomain running a customer-facing service or business-critical integration should be monitored on its own; low-traffic or unused subdomains carry less priority.

Can a DNS record change be legitimate and still worth an alert?
Yes – the alert isn’t necessarily a problem, it’s a confirmation that a change happened. Being notified of an intentional change is still valuable as a record of when it occurred.

Is monitoring DNS records the same as monitoring domain expiry?
No – DNS records control configuration, while domain expiry concerns the registration itself. See the full DNS and Domain Monitoring guide for how the two relate.

See what Sentinel can monitor

Sentinel audits DNS records across every monitored domain to catch misconfiguration and unexpected changes early. See what Sentinel can monitor.