DNS Change Monitoring Workflow (n8n) vs Baseline Alerts

Monitor DNS changes hourly—and automatically flag risky updates with n8n

This DNS Change Monitoring Workflow for n8n resolves DNS records for your domains on a schedule (or on-demand), compares them to an expected baseline, and classifies any detected changes as standard logs or critical security alerts after a short dedup wait window.

What this workflow does

• Runs hourly via a cron schedule or manually for testing.
• Loads your configuration: monitored domain list, each domain’s expected DNS baseline, and allowed IP prefixes for A/AAAA validation.
• Resolves live DNS records using Node.js DNS lookups for: A, AAAA, MX, NS, TXT, CNAME, SOA.
• Compares current vs baseline to detect added/removed records by DNS type.
• Flags suspicious A/AAAA targets when resolved IPs fall outside the configured allowedIpCidrPrefixes.
• If no changes are found, outputs a “no action” note.
• If changes are detected, assigns severity (Info / Warning / Critical) and builds an alert message with recommended actions.
• Critical alerts are routed through a short wait window before outputting the critical alert payload; non-critical findings go to a standard security log payload.

Use cases

• Detect unauthorized DNS changes affecting web/email routing (A/AAAA, MX, CNAME).
• Verify TXT/NS/SOA stability after deployments or domain provider updates.
• Reduce false positives by validating A/AAAA targets against allowed CIDR IP prefixes.
• Provide an auditable security log stream for routine DNS drift.

Technical details

• Tech stack / nodes: if, set, code, wait, sticky note, manual trigger
• DNS resolution: Node.js built-in dns module (outbound DNS must be permitted from Code nodes)
• Baseline monitoring: compares resolved records to configured expectedRecords values