DNS Shield

Someone changed
your DNS records

A single modified A record redirects your entire website. A deleted MX record kills your email. A hijacked NS record hands your domain to an attacker. You need to know the moment it happens.

7

Record types

30s

Check intervals

16+

Alert channels

SCANNING RECORDS...
example.com
A93.184.216.34
checking
MX10 mail.example.com
NSns1.cloudflare.com
TXTv=spf1 include:_spf.google.com ~all
A185.199.108.153
CNAMEwww → example.com

Every record type, monitored

PulseStack tracks all seven DNS record types. Each serves a different purpose and each has its own failure mode. Click a record type to learn what it does and what goes wrong when it changes.

AAddress Record

Maps your domain to an IPv4 address. The most fundamental DNS record — if this is wrong, your website is unreachable.

Example

93.184.216.34

When this goes wrong

Hijacked A records redirect all website traffic to attacker-controlled servers

dns-lookup — pulsestack
$dig

Free tool

Look up any domain's DNS records

Query A, AAAA, MX, NS, CNAME, TXT, and SOA records for any domain using Google and Cloudflare DNS resolvers. Results show all record values with query performance metrics.

Use this to audit your DNS configuration, verify changes after a migration, or investigate email delivery issues caused by missing SPF or MX records. The tool is free with no signup required.

For continuous monitoring that alerts you the moment any record changes, create a free PulseStack account. Each domain uses one monitor, and the free plan includes 50 monitors.

Google DNS (8.8.8.8) + Cloudflare (1.1.1.1)
All 7 record types resolved in parallel
Query time measured in milliseconds
No signup — check unlimited domains

Protect your DNS in 30 seconds

Add a domain, choose your alert channels, and PulseStack watches every record for changes.

Start free

DNS threats that monitoring catches

DNS is attacked more often than most teams realise. Each attack type produces a different signature that PulseStack's change detection identifies immediately.

DNS Hijacking

Attacker modifies DNS records at the registrar or nameserver level, redirecting your domain to their infrastructure.

A/NS record change detection

Cache Poisoning

Fake DNS responses injected into resolver caches, sending users to malicious servers without touching your actual records.

Cross-resolver comparison

Subdomain Takeover

Abandoned CNAME records pointing to decommissioned cloud services claimed by an attacker.

CNAME target validation

Email Interception

MX records modified to route incoming email through attacker-controlled mail servers before forwarding to yours.

MX record change alerts

SPF/DKIM Stripping

TXT records containing email authentication policies deleted or weakened, enabling spoofing of your domain.

TXT record monitoring

Zone Transfer Leak

Misconfigured nameservers allowing anyone to download your entire DNS zone, revealing internal infrastructure.

SOA serial monitoring

Email protection

Your email lives in your DNS records

Email deliverability depends entirely on three DNS record types: SPF defines which servers can send email on your behalf, DKIM provides cryptographic signatures that prove messages are genuine, and DMARC tells receiving servers how to handle messages that fail SPF or DKIM checks. All three are stored as TXT records in your DNS zone.

A deleted SPF record means any server in the world can send email pretending to be your domain. A misconfigured DKIM record causes legitimate email to fail signature verification and get flagged as spam. A missing DMARC record removes your ability to control how receiving servers handle suspicious messages claiming to be from you.

These failures happen silently. Your outbound email continues to send normally from your mail server's perspective. But on the receiving end, messages are being rejected, quarantined, or marked as spam. The first sign of trouble is usually a customer saying they never received your invoice.

PulseStack monitors all TXT records and alerts you the moment SPF, DKIM, or DMARC records change or disappear. Combined with HTTP uptime monitoring and SSL certificate monitoring, you have complete visibility into every layer of your domain infrastructure.

Email DNS records

SPFTXT record

Defines authorised mail servers

v=spf1 include:_spf.google.com ~all

DKIMTXT record

Cryptographic email signatures

v=DKIM1; k=rsa; p=MIGfMA0G...

DMARCTXT record

Policy for failed authentication

v=DMARC1; p=reject; rua=mailto:...

MXMX record

Mail server routing

10 mail.example.com

Simple pricing. Start free.

50 monitors free forever. Each domain uses one monitor. Upgrade when you need faster checks.

Free

£0forever

  • 50 monitors
  • 3-min checks
  • Email alerts
  • 5 status pages
Start free

Most popular

Pro

£29/month

  • 200 monitors
  • 30-sec checks
  • All 16+ alert channels
  • 90-day data retention
Get started

Enterprise

£89/month

  • 500+ monitors
  • 30-sec checks
  • SSO & audit logs
  • Dedicated support
Contact us

All plans include multi-location checks, incident management, and public status pages. Full plan comparison →

Frequently asked questions

Everything you need to know about DNS record monitoring and change detection.

Would you know if someone
changed your DNS records?

Add your domains, configure your alerts, and PulseStack watches every record for changes. Free for 50 monitors.

Start DNS monitoring free