CertaDNS
Skip to lesson

Monitoring Channels · lesson 3 of 3

Watching your own estate

After this lesson you can

Detect an unauthorised change to your own records before anybody outside does.

Assumes you have read Certificate streams.

Brand protection points outward by default, and the highest-impact finding is usually inward: a change to your own records that nobody authorised.

What to watch on your own estate

WatchAlert whenBecause
The NS RRset of every domainIt changesA delegation change is either a planned migration or a hijack, and you know which.
The DS record at the parentIt appears or disappearsRemoving DNSSEC is a step an attacker takes and nobody else does quietly.
MX recordsThey changeMail redirection is the quietest possible compromise.
A and CNAME targetsA target stops resolvingThat is a dangling record, and it is now claimable.
Registrar domain status codesA lock is removedNobody removes a transfer lock by accident.
Expiry datesUnder 60 days with auto-renew offExpiry is a total loss with no attacker required.
Certificates issued for your namesOne appears that you did not requestCT makes misissuance and takeover visible, and only if somebody looks.

Your own names in CT

The same certificate stream that finds lookalikes will tell you when a certificate is issued for a name of yours. If you did not request it, one of three things happened: a team you do not know about issued it, a subdomain was taken over, or a CA misissued.

Certificate observed for  legacy.example.com
Issued:                   2026-09-14
Requested by us?          no

-> Does legacy.example.com still resolve?
   yes, to a SaaS platform we cancelled in 2024
-> A dangling CNAME was claimed. The attacker passed
   domain validation because the name points at them.

That is a subdomain takeover detected from the outside, through a channel you were already running for another reason. It is one of the strongest arguments for pointing the monitoring at yourself as well.

The part that is hard

  • Knowing what your estate is. A list of domains maintained by hand goes stale, and a change to a domain nobody knew you owned is a change nobody is watching.
  • Distinguishing planned from unplanned. Every alert needs a way to check whether a change was authorised, or the channel becomes noise during a migration.
  • Coverage across registrars. Estates accumulate across several, each with its own interface and no shared view.

Alert on the delegation before anything else

A changed NS RRset is the single highest-value alert in this list. It means somebody else is now answering for the domain — every other record, the mail, the certificates and the policies — and it is one query to check, on a schedule, for every domain you own.

Last reviewed