DNS Guardian

DNS Guardian is a cross-platform command-line tool that monitors your domains for unauthorized DNS changes and sends email alerts the moment drift is detected. Define your expected DNS records — A, NS, MX, CNAME — and get notified within minutes if anything changes without your knowledge.

Available for Linux, macOS, and Windows. Single binary, zero dependencies, installs in seconds.

Why DNS Monitoring Matters

DNS is the foundation of your online presence. When an attacker compromises your DNS — whether through registrar hijacking, cache poisoning, or unauthorized zone changes — they can redirect your traffic, intercept emails, or impersonate your website. Without monitoring, these changes can go unnoticed until customers or colleagues report problems. DNS Guardian closes that gap by checking your records on a schedule and alerting you immediately when something drifts.

How It Works

• You define expected DNS values in a simple YAML config — or let the first run capture a baseline automatically
• On each scheduled run, DNS Guardian queries live DNS and compares results against your expected values or stored snapshots
• If any record has changed, a detailed email alert is sent showing exactly what drifted
• The alert includes the domain, record type, expected values, and actual values detected
• Use --reset to accept legitimate changes and establish a new baseline

What To Monitor

• A records — IP addresses your domain points to
• NS records — nameservers authoritative for your domain
• MX records — mail servers handling your email
• CNAME records — aliases pointing to other domains
• AAAA records — IPv6 addresses
• TXT records — SPF, DKIM, verification entries

Key Features

• Monitors A, AAAA, NS, MX, CNAME, and TXT records for any number of domains
• Two detection modes: config-defined expected values, or automatic baseline snapshots
• Email alerts via SMTP with TLS (port 465) and STARTTLS (port 587) support
• Alerts show exactly what changed — domain, record type, expected vs. actual
• Configurable DNS resolver (use Google, Cloudflare, or any resolver)
• Cron-friendly with quiet mode — no noise, alerts only when drift occurs
• Dry-run mode to test your setup without triggering alerts
• Reset mode to take fresh snapshots after legitimate DNS changes
• Summary reports sent via email on schedule
• Cross-platform — runs on Linux, macOS, and Windows
• Single static binary, zero runtime dependencies
• Minimal resource usage — lightweight DNS queries, runs anywhere

Who Needs This

• Sysadmins and DevOps teams managing production domains
• Security teams monitoring for DNS hijacking and domain takeover
• Web agencies managing client domains and hosting
• E-commerce businesses protecting customer-facing domains
• Anyone who needs to know immediately when their DNS changes unexpectedly

Quick Start

1. Download the binary for your platform
2. Copy config.example.yaml to config.yaml and add your SMTP details and domains
3. Run dnsguardian --config config.yaml --test to verify email works
4. Run dnsguardian --config config.yaml --reset to take initial snapshots
5. Add a cron job to check every 5 minutes — done