Your DNS changed and you didn't change it — now what

DNS is the phonebook of the internet: it decides which server answers when someone types your domain, and which servers are allowed to receive your email. Most site owners never touch it — which is exactly why an unexpected DNS change deserves your full attention. A changed record can send your visitors to someone else's server, or your email into someone else's inbox.

First, rule out the innocent explanations

Before panicking, check the boring causes. Did your host migrate you to new servers? Did a colleague or contractor make a change? Did you switch email providers, add a verification record, or move nameservers recently? Any of these legitimately change records. If you find the change in a ticket, an email from your host, or a teammate's memory, you are done — note it and move on.

If nobody changed anything, treat it as urgent

An unexplained change means either an account is compromised or a provider made an error. Work through this list in order:

1. Look at what changed. A changed A record points your website elsewhere; a changed MX record points your email elsewhere; changed nameservers hand control of everything to someone else. The record type tells you what is at risk.

2. Secure the accounts. Change the passwords for your registrar and hosting accounts, turn on two-factor authentication if it is not on, and check for unfamiliar users, API keys, or forwarding rules.

3. Restore the records. Put back the values from before the change. Your host or registrar support can usually supply the correct records if you are unsure.

4. Watch propagation. DNS changes take time to spread — minutes to hours depending on TTL. Verify from more than one location before declaring it fixed.

Prevention that actually works

Turn on your registrar's transfer lock and two-factor authentication, keep the number of people with DNS access small, and — most importantly — get alerted when records change. A daily snapshot of your DNS, compared against the previous day, turns "we found out three weeks later" into "we found out the same day". That is the difference between a quick restore and a quiet hijack.

Run a free health scan to see your current DNS records and whether anything looks off.