DNS Monitor

Detector monitors DNS for potential attacks (like DNS Hijacking)

​

Functionality

• Detector monitors WHOIS and DNS server records for changes
• WHOIS is mulitple registries for domains registration infomation
• Nameservers for Domain resolution.

If Nameserver field is empty, it will not be checked.

• List of IP addresses domain is resolved to. Use , (semicolon) for mulitple IP addresses
• It is a date when to start alerting about Domain expiration. It should be before Domain expiration date.

Use date format, not time should be specified (e.g. 2026-01-25) If no value is specified expiration will not be checked.

• Cron expression (Quartz expression syntax, millisecond value or seconds/minutes/hours expression)

Periodic check example: 10 min Cron expression is Quartz syntax example for every hour: 0 0 0/1 1/1 * ? *”

​

Configuration

• Cron (cron, default: 10 min): Cron expression to check DNS See common configuration.
• Domain (domain, default: “): Domain to monitor
• IP address(s) (ip, default: “): List of expected resolved addresses
• NS1 (ns1, default: “): Nameserver
• NS2 (ns2, default: “): Nameserver
• NS3 (ns3, default: “): Nameserver
• NS4 (ns4, default: “): Nameserver
• Expiry Alert date (expiry_alert, default: “): The date when to start alerting about expriration
• Severity (severity, default: -1): Severity See common configuration.