Brand protection points outward by default, and the highest-impact finding is usually inward: a change to your own records that nobody authorised.
What to watch on your own estate
| Watch | Alert when | Because |
|---|---|---|
| The NS RRset of every domain | It changes | A delegation change is either a planned migration or a hijack, and you know which. |
| The DS record at the parent | It appears or disappears | Removing DNSSEC is a step an attacker takes and nobody else does quietly. |
| MX records | They change | Mail redirection is the quietest possible compromise. |
| A and CNAME targets | A target stops resolving | That is a dangling record, and it is now claimable. |
| Registrar domain status codes | A lock is removed | Nobody removes a transfer lock by accident. |
| Expiry dates | Under 60 days with auto-renew off | Expiry is a total loss with no attacker required. |
| Certificates issued for your names | One appears that you did not request | CT makes misissuance and takeover visible, and only if somebody looks. |
Your own names in CT
The same certificate stream that finds lookalikes will tell you when a certificate is issued for a name of yours. If you did not request it, one of three things happened: a team you do not know about issued it, a subdomain was taken over, or a CA misissued.
Certificate observed for legacy.example.com Issued: 2026-09-14 Requested by us? no -> Does legacy.example.com still resolve? yes, to a SaaS platform we cancelled in 2024 -> A dangling CNAME was claimed. The attacker passed domain validation because the name points at them.
That is a subdomain takeover detected from the outside, through a channel you were already running for another reason. It is one of the strongest arguments for pointing the monitoring at yourself as well.
The part that is hard
- Knowing what your estate is. A list of domains maintained by hand goes stale, and a change to a domain nobody knew you owned is a change nobody is watching.
- Distinguishing planned from unplanned. Every alert needs a way to check whether a change was authorised, or the channel becomes noise during a migration.
- Coverage across registrars. Estates accumulate across several, each with its own interface and no shared view.
Alert on the delegation before anything else
A changed NS RRset is the single highest-value alert in this list. It means somebody else is now answering for the domain — every other record, the mail, the certificates and the policies — and it is one query to check, on a schedule, for every domain you own.