Sign up
Log in

DNS check Knowledge Base

NS IP address check

Prerequisites:

None.

Package:

Integrity.

Executed on:

All authoritative name servers for each NS name.

Check interval:

Every 5 minutes.

Impact on Availability:

None.

Impact on Integrity:

High.

Purpose

The check validates that the IP addresses to the DNS servers are correct.

The NS resource record set points to the authoritative name servers for the domain. Each of these name server names resolves to IP addresses. These IP addresses can be of the IPv4 and/or IPv6 family. It is of the utmost importance that these IP addresses resolve to what is expected. Failure to resolve to the correct IP address might indicate tampering on one or more DNS servers.

When the domain is initially set up for monitoring, the DNS monitor configuration engine will resolve each NS resource records IP addresses and store them in our database. These IP addresses are compared to the check results from each authoritative name server serving these records.

The check will issue an error severity if any discrepancy is detected and the result will also trigger an error event on the Integrity check due to its impact.

Event severities and messages

INFO

The response matches with the expected values.
All name server names resolve to the correct IP address on all authoritative name servers.

ERROR

Unrecognised records.
The check identified IP addresses that doesn’t exist from the original configuration. If this is correct the domain needs to be reconfigured to pick up the new IP addresses.

Missing records.
The check identified IP addresses that should be configured but aren’t. These error messages can be caused due to:

  • Someone has changed the IP address on a DNS server. If this is a legitimate change do a reconfiguration of the domain in the monitoring GUI or through the API. This will update the monitoring data with the current (correct) IP addresses.
  • If the IP address has been changed and it is not sanctioned, there is a risk that one or more servers might have been hijacked and false data might be returned from the rogue IP.

UNKNOWN

Something went wrong {error code}.
The check was unable to acquire the correct information to complete its task. Please refer to the error code for possible cause.

Solutions, tips & tricks

Make sure you monitor the DNS records that are important to your organisation.

Minimise the number of people with administrative access to your domains and who are authorised to change host names.

Use MFA (Multi Factor Authentication) on all administrative accounts allowed to make changes to your domains if possible. This is especially vital if you use a third party vendor (DNS service provider and such). Also make sure that you are not using the same password on multiple accounts across the Internet.