DNS Guardian

DNS Guardian is a cross-platform command-line utility that observes your domains for unauthorized DNS modifications and delivers email notifications the instant drift is identified. Specify your expected DNS records — A, NS, MX, CNAME — and receive alerts within minutes if anything shifts without your approval.

Available for Linux, macOS, and Windows. Single binary, zero dependencies, deploys in seconds.

Why DNS Observing Matters

DNS underpins your entire online presence. When an intruder compromises your DNS — through registrar hijacking, cache poisoning, or unauthorized zone modifications — they can redirect your traffic, intercept emails, or impersonate your website. Without observing, these modifications can go undetected until customers or colleagues report issues. DNS Guardian closes that gap by verifying your records on a schedule and notifying you without delay when something drifts.

How It Operates

• You specify expected DNS values in a simple YAML config — or let the initial run capture a baseline autonomously
• On each scheduled run, DNS Guardian queries live DNS and compares results against your expected values or stored snapshots
• If any record has shifted, a detailed email notification is sent showing precisely what drifted
• The notification includes the domain, record type, expected values, and actual values identified
• Use --reset to accept legitimate modifications and establish a new baseline

What To Observe

• A records — IP addresses your domain resolves to
• NS records — nameservers authoritative for your domain
• MX records — mail servers handling your email
• CNAME records — aliases pointing to other domains
• AAAA records — IPv6 addresses
• TXT records — SPF, DKIM, verification entries

Core Capabilities

• Observes A, AAAA, NS, MX, CNAME, and TXT records for any number of domains
• Two identification modes: config-defined expected values, or automatic baseline snapshots
• Email notifications via SMTP with TLS (port 465) and STARTTLS (port 587) support
• Notifications show precisely what changed — domain, record type, expected vs. actual
• Configurable DNS resolver (use Google, Cloudflare, or any resolver)
• Cron-friendly with quiet mode — no noise, notifications only when drift occurs
• Dry-run mode to test your setup without triggering notifications
• Reset mode to capture fresh snapshots after legitimate DNS changes
• Summary reports delivered via email on schedule
• Cross-platform — operates on Linux, macOS, and Windows
• Single static binary, zero runtime dependencies
• Minimal resource usage — lightweight DNS queries, operates anywhere

Ideal For

• Sysadmins and DevOps teams administering production domains
• Security teams observing for DNS hijacking and domain takeover
• Web agencies administering client domains and hosting
• E-commerce businesses protecting customer-facing domains
• Anyone who requires immediate visibility when their DNS changes unexpectedly

Quick Start

1. Download the binary for your platform
2. Copy config.example.yaml to config.yaml and add your SMTP details and domains
3. Run dnsguardian --config config.yaml --test to verify email operates
4. Run dnsguardian --config config.yaml --reset to capture initial snapshots
5. Add a cron job to check every 5 minutes — done