> ## Documentation Index
> Fetch the complete documentation index at: https://docs.extractor.live/llms.txt
> Use this file to discover all available pages before exploring further.

# DNS Monitor

> Detector monitors DNS for potential attacks (like DNS Hijacking)

Detector monitors DNS for potential attacks (like DNS Hijacking)

## Functionality

* Detector monitors WHOIS and DNS server records for changes
* WHOIS is mulitple registries for domains registration infomation
* Nameservers for Domain resolution.

If Nameserver field is empty, it will not be checked.

* List of IP addresses domain is resolved to. Use `,` (semicolon) for mulitple IP addresses
* It is a date when to start alerting about Domain expiration. It should be before Domain expiration date.

Use date format, not time should be specified (e.g. `2026-01-25`)

If no value is specified expiration will not be checked.

* Cron expression (Quartz expression syntax, millisecond value or seconds/minutes/hours expression)

Periodic check example: `10 min`

Cron expression is Quartz syntax example for every hour:  `0 0 0/1 1/1 * ? *`"

## Configuration

* **Cron** (`cron`, default: `10 min`): Cron expression to check DNS See [common configuration](https://docs.extractor.live/common-configurations.md#cron).
* **Domain** (`domain`, default: \`\`): Domain to monitor
* **IP address(s)** (`ip`, default: \`\`): List of expected resolved addresses
* **NS1** (`ns1`, default: \`\`): Nameserver
* **NS2** (`ns2`, default: \`\`): Nameserver
* **NS3** (`ns3`, default: \`\`): Nameserver
* **NS4** (`ns4`, default: \`\`): Nameserver
* **Expiry Alert date** (`expiry_alert`, default: \`\`): The date when to start alerting about expriration
* **Severity** (`severity`, default: `-1`): Severity See [common configuration](https://docs.extractor.live/common-configurations.md#severity).

> [!NOTE]
>
> No specific network configuration required (Any network).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.