Catch the DNS change before the attacker uses it

FortWatch baselines your current DNS state on first scan and compares every subsequent check against it. New A records, changed MX targets, removed TXT records, modified DMARC policies — all flagged with the exact diff and a timeline of when the change happened. Useful for catching unauthorized DNS changes (compromised registrar account, rogue admin) and accidental drift after deploys.

Yes. We resolve every CNAME on every monitored subdomain and check whether the target is still claimed. Dangling CNAMEs pointing to deprovisioned S3 buckets, retired Heroku apps, expired Azure resources, or unclaimed GitHub Pages are flagged with provider-specific takeover instructions for verification.

Both. Email auth (SPF/DKIM/DMARC) is one part — but we also audit infrastructure DNS: A and AAAA records, NS records (registrar lock status, DS hash for DNSSEC), CAA records (which CAs are allowed to issue certs for your domain), and zone-level health. The whole DNS surface, not just the email part.

DNS scans run continuously — every 6 hours by default for standard assets, hourly for assets you mark as critical. You can also trigger an on-demand scan after a registrar change. Each check runs against multiple resolvers to catch propagation issues and resolver-specific mismatches.