Domain monitoring is the practice of checking a domain name continuously, on an automated schedule, and raising an alert the moment something about it changes. The checks cover the registration record, the nameservers, the DNS records, the EPP status codes (the registry flags that permit or block transfers, updates and deletions), the expiration date, the SSL certificate, and, for a brand, the stream of new registrations that resemble its name. A registrar sends a renewal reminder once or twice a year. A domain monitoring service watches every few minutes.
We built DNShield, our domain name monitoring service, because the stolen domain cases we handle almost always share one feature: nobody noticed in time. The registrant learned of a hijacking when customers reported the website gone, when email stopped arriving, or when a buyer asked why the domain had just been listed for sale. By then the name had often passed through two registrars and a reseller. The earlier a change is seen, the cheaper and faster the recovery, and the only reliable way to see a change early is to be looking for it.
What domain monitoring is
At its simplest, domain name monitoring takes a snapshot of a domain’s public records and compares each new snapshot against the last one. The records involved are public by design. Anyone can query the registration data through RDAP (the Registration Data Access Protocol, the HTTPS-based successor to WHOIS), resolve the domain’s nameservers and DNS records, fetch the certificate the web server presents, and read the status codes the registry has applied. A monitoring service does all of this on a timer and keeps the history, so that when a value differs from the previous one, it can say precisely what changed, when it changed, and what the old value was.
A single lookup tells you the state of a domain today. Monitoring tells you that the registrant organization was “Acme Holdings” at 09:12 and “Privacy Service” at 09:27, that the nameservers moved from your DNS provider to a pair of servers you have never heard of, or that a clientTransferProhibited status (the registrar-applied lock that blocks a transfer request) was removed yesterday afternoon. Each is an event with a timestamp, and a timestamp is evidence.
The records a domain monitoring service checks
The registration record carries the contacts, the sponsoring registrar, the creation and expiration dates, and the status codes. The nameserver set tells you which servers answer authoritatively for the domain, which is the single most consequential setting on a domain because whoever controls the nameservers controls where the website and email go. The DNS records themselves (A and AAAA records for the web server addresses, MX records for mail routing, TXT records that carry SPF and DMARC email authentication policies, and CNAME records for aliases) govern the services the domain actually provides. The SSL certificate has its own expiration date, independent of the domain’s, and a certificate issued by a certificate authority you do not use is a strong sign that someone else has demonstrated control of the domain. Finally, the domain’s own expiration date determines whether the registration survives the year.
Two different jobs under one name
The term “domain monitoring” covers two activities with different goals and audiences, and the distinction matters when you decide what to buy.
Protecting the domains you already own
The first job is defensive. You watch your own portfolio for unauthorized changes: a registrant change that signals a hijacking, a nameserver change that signals DNS tampering, a removed transfer lock that precedes an outbound transfer, a lapsed renewal that is about to put the name into the expiration lifecycle, or a certificate issued without your request. The audience is the IT or security team and, for a smaller company, the owner. The question being answered is “is my domain still mine and still configured the way I left it?”
This kind of monitoring is the registrant’s own control, independent of the registrar. ICANN’s Security and Stability Advisory Committee has recommended exactly this since 2010, when SAC044, A Registrant’s Guide to Protecting Domain Name Registration Accounts, set out seven WHOIS-check questions and six DNS monitoring checks that registrants should perform themselves, alongside the clientTransferProhibited, clientUpdateProhibited and clientDeleteProhibited status codes and a registry lock as an additional layer. The guidance is from 2010, but the checks it describes are the ones a service automates today.
Watching for domains others register against your brand
The second job is offensive, or at least outward-looking. You watch the new registrations across hundreds of top-level domains for names that resemble your brand: typosquats (misspellings such as a dropped or transposed letter), lookalikes (homoglyphs that swap a letter for a visually similar character, or your brand plus a word such as “support” or “login”), and registrations in new extensions you do not hold. The audience is the brand protection, legal or marketing team. The question is “is someone preparing to impersonate us?”
The two jobs use different data feeds. The first queries your own domains repeatedly. The second processes zone files (the daily lists of every registered name in a top-level domain), newly observed domain feeds, and certificate transparency logs (the public, append-only records of every SSL certificate issued) to find names that match a pattern. Many organizations need both, and the sibling guide on phishing domain monitoring covers the second job in detail.
Why registrar notices are not enough
Every registrar sends notices. The problem is where they go and when they arrive. Registrar notices go to the email address on the account. In a hijacking, the attacker’s first move is usually to take over that mailbox or to change the account’s contact address, which means the “your domain has been transferred” notice lands in a mailbox the attacker controls. The registrant never sees it. In the recoveries we handle, the registrar’s records often show every notice sent and acknowledged, because the person acknowledging them was the thief.
Notices also arrive after the fact. A transfer confirmation tells you a transfer has happened. A monitoring alert on the removal of the transfer lock tells you one is about to happen, while you can still call the registrar and have the lock reinstated. The difference between those two moments is the difference between a ten-minute phone call and a multi-week recovery through the losing registrar’s Transfer Emergency Action Contact (the human contact every registrar must staff for urgent transfer disputes), a Transfer Dispute Resolution Policy filing, or litigation.
Expiration is the other case where notices fail. Under the current Expired Registration Recovery Policy, registrars must send two expiration notices, approximately one month and one week before expiration, and a further notice within five days after expiration, as set out in ICANN’s 2024 ERRP redline. Those notices go to the same contact address. If the person who registered the domain left the company, if the card on file expired, or if the notices are filtered as marketing mail, the domain expires on schedule and nobody reads the warning. The sibling guide on domain expiration monitoring explains how an independent expiration alert, sent to several people, prevents that.
What the research says about lapsed and stolen domains
The consequences of a missed change are well documented, and the measurements explain why minutes matter.
Expired domains are taken immediately
A domain that expires and passes through the redemption period does not sit quietly waiting for its old owner. In a four-week measurement of more than four million domains, Lauinger and colleagues at USENIX Security 2017 found that 10.1% of deleted .com domains were re-registered on the same day their old registration was deleted, that drop-catch services controlled over 75% of accredited registrars, and that over half of .org drop-day re-registrations occurred within the first 30 seconds. The mechanism is simple: drop-catching firms operate large pools of registrar accreditations so they can submit thousands of create commands at the instant the registry releases the name. A former owner who notices a week later is competing against automation that finished in under a minute.
Who catches those names, and why, is equally instructive. Monitoring 28,401,974 pending-delete .com, .net and .org names over nine months in 2017, Miramirkhani and colleagues at WWW 2018 found that dropcatchers representing 0.03% of registrant clusters registered 60% of caught domains, that previously malicious domains were caught about twice as often as benign ones, that 94% of 6,838 subverted domains served malware, and that less than 11% of caught domains hosted real web content. The names are caught for their residual value.
Residual trust is the asset the new owner buys
That residual value is the trust the old domain accumulated: links from other sites, bookmarks, configured mail clients, API integrations, and software that still calls the old hostname. In Squarcina and colleagues’ IEEE S&P 2022 study of residual trust, researchers re-registered 201 expired domains for a total of $1,464.64, about $7.29 each, and received 650,737,621 requests from 5,540,379 unique IP addresses in four months, with at least 50.58% of HTTP(S) clients classified as residual-trust traffic. One former torrent tracker drew over 2.5 million unique IPs. For a company that lets a corporate domain lapse, that traffic includes its customers’ password resets, its staff’s email, and its internal systems reaching for services that no longer belong to it. The same study found that 20.9% of the domains had previously hosted real-money gambling and 16.42% were crime-related, which is why anyone buying an aged domain should commission a domain name background check before relying on it.
Attackers move fast, and brands are the targets
On the hijacking side, the dwell time is short. In their retroactive study of targeted DNS infrastructure hijacking, Akiwate and colleagues at ACM IMC 2022 found that for 51% of hijacked domains the attacker’s resolution lasted at most one day, and that attackers obtained suspicious certificates for 40 hijacked domains, only four of which were revoked. A check that runs once a day can miss an entire attack. A check that runs every few minutes, combined with certificate transparency monitoring, catches the nameserver change and the certificate issuance while they are happening.
The volume of brand-impersonating domains sets the scale for the second monitoring job. The APWG recorded 892,494 phishing attacks in the third quarter of 2025 targeting 427 unique brands, with SaaS and webmail providers the most targeted sector at 21.2%, financial institutions at 13.2%, and an average business email compromise wire-transfer request of $48,115, according to the APWG Phishing Activity Trends Report for Q3 2025. Over a full year, Interisle Consulting Group’s 2025 phishing study counted 1,963,390 distinct phishing attacks between May 2024 and April 2025 using 1,542,922 unique domain names, and found that 77% of phishing domains were maliciously registered rather than compromised. That last figure is the one that justifies monitoring new registrations: three quarters of the domains used to impersonate brands were registered for that purpose, which means they appeared in a zone file or a certificate log before the first phishing email went out. Lookalike domains with mail configured are the clearest early signal; CSC’s 2024 Domain Security Report found that 80% of homoglyph domains resembling Global 2000 brands are owned by third parties and that 42% of those had MX records in 2024, meaning they were set up to send or receive email.
What good alerts look like
A monitoring service is only as useful as its alerts, and the alerts that work share a few properties. They arrive in minutes, not days, because the research above shows that an attacker’s window can be a single day and a drop-catcher’s window is seconds. They go to more than one person and to more than one channel. Email is necessary but not sufficient, since the mailbox is often the first thing compromised; a webhook (an automated HTTP call to another system) that posts into a ticketing queue, a chat channel or a security information and event management platform means the alert survives the loss of any single inbox. They carry a diff: the old value, the new value and the time of the change, so the recipient can judge severity without running a lookup. A nameserver change from one provider to another, with a timestamp, is actionable. “Something changed on example.com” is not.
Good alerts are also tuned to avoid noise. A domain’s DNS answers can legitimately vary when a content delivery network rotates addresses, and a service that fires on every rotation trains its recipients to ignore it. The useful signals are changes to the registration record, the nameserver set, the status codes, the MX and authentication records, the certificate issuer and the expiration dates, because those values should be stable.
How DNShield works
DNShield, our domain name monitoring service, performs the defensive job described above for the domains a client enrolls. It queries the registration data, nameservers, DNS records and status codes on a short interval, stores each result, and compares every new result against the previous one. When a value changes, it sends an alert that names the field, shows the old and new values, and gives the time of the change. The alert types are registrant changes, nameserver changes, DNS record changes, status code changes, domain expiration warnings and SSL certificate expiry warnings. Alerts can be delivered by email and by webhook, so a client’s security team can route them wherever its existing incident process lives.
Because DNShield runs independently of the registrar, it does not depend on the registrar’s notices, the account’s contact email, or the account being under the client’s control. If an attacker takes over a registrar account and changes the nameservers, the registrar’s confirmation goes to the attacker, and the DNShield alert goes to the client. That independence is the reason we recommend monitoring as the companion to every other control, including registry lock, multi-factor authentication on the registrar account, and the broader measures covered in our domain security guide. A lock stops most changes; monitoring tells you about the ones that got through, and about the ones that were authorized by someone who should not have had the authority.
We have written separately about what domain monitoring is for readers new to the subject, and about monitoring domain name availability for readers waiting for a specific name to drop.
Monitoring also produces the record a recovery needs. When we take on a stolen domain, the first task is a timeline of when the registrant, nameservers and registrar changed, and in what order. A client who has been monitoring already has that timeline, with timestamps, from an independent source. Our guide to domain hijacking describes how those attacks unfold and why the first day matters so much.
Guides in the domain monitoring hub
The pages below go deeper on the subjects covered here, and we add to this list as new guides are published.
- DNShield domain name monitoring is the DNAccess service that runs the checks described on this page.
- What is domain monitoring? is the short introduction for readers new to the subject.
- Monitoring domain name availability covers watching for a specific name to become available.
- Domain expiration monitoring explains how to never lose a domain to a missed renewal.
- Phishing domain monitoring covers finding lookalikes before the emails go out.
What DNAccess does
DNAccess provides DNShield domain name monitoring for companies, law firms and domain investors who need to know within minutes if a registration record, nameserver, DNS record, status code or certificate changes on a domain they own, and to receive expiration warnings for both the domain and its certificate well before either lapses. For the second monitoring job, watching for typosquats, lookalikes and phishing registrations against a brand, we offer online brand protection services that combine registration feeds with blocking and enforcement. When monitoring reveals that a domain has already been taken, our stolen domain name recovery team, which has recovered hundreds of stolen domains, handles the registrar escalation, the evidence and, where necessary, the legal process. To discuss which domains in your portfolio should be monitored and how alerts should be routed, contact us.