Domains
Change events: "Did you make this change?"
How DomainGuard detects DNS, nameserver, registrar and certificate changes, the question it asks, and the lifecycle each event goes through.
Updated · 2 min read
A domain is hijacked by changing things that look ordinary one at a time: a nameserver, an MX record, a registrar lock, a certificate. DomainGuard compares each scan with the last one and turns every difference into an event with a question attached: did you make this change?
Where to see it
- Web: the domain's History module and Monitor, Changes. The portfolio feed is under Overview.
- iOS: the Alerts tab shows "Did you make this change?" cards; the domain page leads with what changed and when if its status moved since you last looked, with a timeline of changes and chips for everything still fine.
- API/MCP:
GET /api/domain-events(account-wide),GET /api/domains/:id/events, and the toolsget_domain_events,get_domain_hijack_events,get_domain_event,act_on_domain_event.
What is compared
Successive scans are diffed field by field: A and AAAA records, the MX set and status, the NS set and status, SPF, DKIM and DMARC records, registrar data, and the certificate. Detection runs on the five-minute tick, up to 25 new events per pass, and an identical change is not raised again for 30 days.
The older GET /api/domains/dns-changes feed still exists and lists record-level DNS changes; the event lifecycle described here is its successor.
Severity
Each event carries a severity. A nameserver change or a new MX at a domain that sends mail is high; an A record moving between two addresses at the same host is low. The severity decides whether the push is time-sensitive.
The lifecycle
| State | Meaning |
|---|---|
| Open | Detected, not yet answered |
| Acknowledged | Seen |
| Investigating | Being looked at |
| Resolved | Dealt with |
Two answers are the ones that matter:
- Authorize ("we made this change") promotes the new value to the baseline, so it stops alerting and the next scan compares against it.
- Deny ("we did not") keeps the event flagged and the old value as the baseline, so the event stays open until the record is put back or you resolve it deliberately.
The history keeps what changed, from what to what, when, and what you answered.
Alerts
Reading events is free on every plan. Being told about one at the moment it happens goes through the notification settings: DNS record changes push and email, with email on paid plans. See Notification settings.
Common questions
My DNS host rotates IPs. Will every rotation alert? A change is raised once and then deduplicated for 30 days. Authorize it and the new values become the baseline; if the host cycles between a small set of addresses, you will see one event per new value, not one per rotation.
Does DomainGuard change anything back? No. It records and asks. Reverting a change is done at your DNS host or registrar.
Keep reading
Related articles
- Subdomain discovery and per-host resultsHow hosts under a domain are found (certificate logs and DNS), the 100-host limit, and what each host's page shows: status, certificate, ports and findings.Domains ·Updated
- Verdicts, change events and the evidence packTell DomainGuard what a lookalike is (ours, unrelated or known), read the change history for each, and assemble the pack for an abuse report or takedown filing.Impostor domains ·Updated
- Domain health scanWhat the domain scan reads (DNS, nameservers, DNSSEC, the registrar record, expiry) and how the registration expiry notices are timed.Domains ·Updated