> ## Documentation Index > Fetch the complete documentation index at: https://docs.extractor.live/llms.txt > Use this file to discover all available pages before exploring further. # DNS Monitor (legacy) > Legacy DNS Monitor — watches WHOIS and DNS records for hijacking attacks and domain expiration warnings on your project's web infrastructure. Monitors DNS for potential attacks such as DNS Hijacking by tracking WHOIS data and DNS server records. ## Functionality * Monitors WHOIS and DNS server records for unexpected changes * Validates nameserver (NS1–NS4) assignments for the monitored domain * Checks that the domain resolves to the expected IP addresses * Alerts when the domain expiration date approaches a configured threshold ## Configuration DetectorDNS Configuration * **Cron** (`cron`, default: `10 min`): How often the DNS check runs. Refer to [Cron](/common-configurations#cron) for more details. * **Domain** (`domain`, default: `""`): The domain to monitor. * **IP address(s)** (`ip`, default: `""`): Expected IP addresses for the domain, comma-separated. * **NS1** (`ns1`, default: `""`): Expected Nameserver 1. If empty, this nameserver will not be checked. * **NS2** (`ns2`, default: `""`): Expected Nameserver 2. If empty, this nameserver will not be checked. * **NS3** (`ns3`, default: `""`): Expected Nameserver 3. If empty, this nameserver will not be checked. * **NS4** (`ns4`, default: `""`): Expected Nameserver 4. If empty, this nameserver will not be checked. * **Expiry Alert** (`expiry_alert`, default: `""`): Date to start alerting about domain expiration (e.g. `2026-01-25`). Must be set before the actual domain expiration date. If not specified, expiration will not be checked. * **Severity** (`severity`, default: `Auto`): Alert [severity](/common-configurations#severity).