{"product_id":"dns-change-monitoring-workflow-n8n-vs-baseline-alerts","title":"DNS Change Monitoring Workflow (n8n) vs Baseline Alerts","description":"\u003ch3\u003eMonitor DNS changes hourly—and automatically flag risky updates with n8n\u003c\/h3\u003e\n\u003cp\u003eThis DNS Change Monitoring Workflow for \u003cstrong\u003en8n\u003c\/strong\u003e resolves DNS records for your domains on a schedule (or on-demand), compares them to an expected baseline, and classifies any detected changes as \u003cstrong\u003estandard logs\u003c\/strong\u003e or \u003cstrong\u003ecritical security alerts\u003c\/strong\u003e after a short dedup wait window.\u003c\/p\u003e\n\n\u003ch3\u003eWhat this workflow does\u003c\/h3\u003e\n\u003cul\u003e\n  \u003cli\u003e\n\u003cstrong\u003eRuns hourly\u003c\/strong\u003e via a cron schedule or \u003cstrong\u003emanually\u003c\/strong\u003e for testing.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eLoads your configuration\u003c\/strong\u003e: monitored domain list, each domain’s \u003cstrong\u003eexpected DNS baseline\u003c\/strong\u003e, and \u003cstrong\u003eallowed IP prefixes\u003c\/strong\u003e for A\/AAAA validation.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eResolves live DNS\u003c\/strong\u003e records using Node.js DNS lookups for: \u003cstrong\u003eA, AAAA, MX, NS, TXT, CNAME, SOA\u003c\/strong\u003e.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eCompares current vs baseline\u003c\/strong\u003e to detect added\/removed records by DNS type.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eFlags suspicious A\/AAAA targets\u003c\/strong\u003e when resolved IPs fall outside the configured \u003cstrong\u003eallowedIpCidrPrefixes\u003c\/strong\u003e.\u003c\/li\u003e\n  \u003cli\u003eIf \u003cstrong\u003eno changes\u003c\/strong\u003e are found, outputs a \u003cstrong\u003e“no action”\u003c\/strong\u003e note.\u003c\/li\u003e\n  \u003cli\u003eIf \u003cstrong\u003echanges are detected\u003c\/strong\u003e, assigns severity (\u003cstrong\u003eInfo \/ Warning \/ Critical\u003c\/strong\u003e) and builds an alert message with recommended actions.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eCritical alerts\u003c\/strong\u003e are routed through a short \u003cstrong\u003ewait window\u003c\/strong\u003e before outputting the critical alert payload; \u003cstrong\u003enon-critical findings\u003c\/strong\u003e go to a standard security log payload.\u003c\/li\u003e\n\u003c\/ul\u003e\n\n\u003ch3\u003eUse cases\u003c\/h3\u003e\n\u003cul\u003e\n  \u003cli\u003eDetect unauthorized DNS changes affecting web\/email routing (A\/AAAA, MX, CNAME).\u003c\/li\u003e\n  \u003cli\u003eVerify TXT\/NS\/SOA stability after deployments or domain provider updates.\u003c\/li\u003e\n  \u003cli\u003eReduce false positives by validating A\/AAAA targets against allowed CIDR IP prefixes.\u003c\/li\u003e\n  \u003cli\u003eProvide an auditable security log stream for routine DNS drift.\u003c\/li\u003e\n\u003c\/ul\u003e\n\n\u003ch3\u003eTechnical details\u003c\/h3\u003e\n\u003cul\u003e\n  \u003cli\u003e\n\u003cstrong\u003eTech stack \/ nodes:\u003c\/strong\u003e if, set, code, wait, sticky note, manual trigger\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eDNS resolution:\u003c\/strong\u003e Node.js built-in \u003ccode\u003edns\u003c\/code\u003e module (outbound DNS must be permitted from Code nodes)\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eBaseline monitoring:\u003c\/strong\u003e compares resolved records to configured expectedRecords values\u003c\/li\u003e\n\u003c\/ul\u003e","brand":"N8N Commerce","offers":[{"title":"Default Title","offer_id":45869883457715,"sku":"N8N-18449","price":70.99,"currency_code":"GBP","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0749\/6279\/6723\/files\/ioEE6tJKj9wcAktcGMoKa_89g50kTI.png?v=1787130207","url":"https:\/\/buyflowscripts.com\/products\/dns-change-monitoring-workflow-n8n-vs-baseline-alerts","provider":"N8N Commerce","version":"1.0","type":"link"}