Which changes deserve review?
Changes to nameservers, mail exchangers, certificate authority authorization, and the addresses for your main domain can affect reachability, mail delivery, or certificate issuance. A new value is a signal to investigate, not proof of compromise. DNS caching and planned provider changes can also explain differences.
- Compare the new value with a documented change window.
- Check the record at your authoritative DNS provider.
- If the change is unexpected, confirm it from an independent source before acting.
What does Guardian do?
After you prove control of the domain, Guardian records a baseline and checks public DNS signals over time. It presents important changes with evidence and a response task. A reviewed, authorized DNS change can be accepted as the new baseline without erasing the earlier record. Guardian does not edit your DNS provider automatically.
What should you do first?
Keep a record of who can change DNS and when. If your website or mail stops working, compare the observed records with the provider configuration, recent deployments, and registrar activity. Restore records only after you know the intended values; a rushed rollback can interrupt legitimate changes.
Example: a planned mail migration
Suppose your team moves email to a new provider on Tuesday. The MX record changes, and the old and new answers may coexist in caches for a while. The useful workflow is to compare the observed value with the change ticket, confirm the new value at the authoritative provider, and check whether mail is arriving. If it matches the plan, document and accept the new baseline. If no one approved it, investigate account access before changing records.