Which DNS records affect the business?
A and AAAA records point hostnames to IPv4 and IPv6 addresses. NS records delegate DNS authority. MX records route incoming mail. CAA records tell certificate authorities which issuers are allowed to issue certificates for the domain. An unexpected value can interrupt service or change where traffic goes, but its presence alone does not establish malicious intent.
How do you review an unexpected change?
Start with the record type, hostname, old and new values, and observation time. Compare them with your DNS provider and a documented change request. A CDN migration, mail provider update, or delegated subdomain can be legitimate. If nobody authorized the change, review registrar and provider access while checking the public answer from another resolver.
- Identify the affected hostname and record type.
- Compare the new value with the authoritative provider and your change history.
- Check the affected website or mail flow before restoring an old value.
What should be prepared before an incident?
Maintain an inventory of the domain registrar, DNS provider, responsible people, and expected critical records. Limit who can edit the zone and require strong account protection at the registrar and DNS provider. Keep a recovery contact who can act if the usual administrator is unavailable.
How Guardian fits in
After domain control verification, Guardian observes selected public DNS records against a baseline and presents supported changes with evidence. It cannot see private provider settings or decide from a DNS difference alone that an attacker changed the zone. It does not make DNS edits for you.