Skip to main content

Documentation Index

Fetch the complete documentation index at: https://doc.extractor.live/llms.txt

Use this file to discover all available pages before exploring further.

Monitors DNS for potential attacks such as DNS Hijacking by tracking WHOIS data and DNS server records.

​
Functionality

  • Monitors WHOIS and DNS server records for unexpected changes
  • Validates nameserver (NS1–NS4) assignments for the monitored domain
  • Checks that the domain resolves to the expected IP addresses
  • Alerts when the domain expiration date approaches a configured threshold

​
Configuration

DetectorDNS Configuration
  • Cron (cron, default: 10 min): How often the DNS check runs. Refer to Cron for more details.
  • Domain (domain, default: ""): The domain to monitor.
  • IP address(s) (ip, default: ""): Expected IP addresses for the domain, comma-separated.
  • NS1 (ns1, default: ""): Expected Nameserver 1. If empty, this nameserver will not be checked.
  • NS2 (ns2, default: ""): Expected Nameserver 2. If empty, this nameserver will not be checked.
  • NS3 (ns3, default: ""): Expected Nameserver 3. If empty, this nameserver will not be checked.
  • NS4 (ns4, default: ""): Expected Nameserver 4. If empty, this nameserver will not be checked.
  • Expiry Alert (expiry_alert, default: ""): Date to start alerting about domain expiration (e.g. 2026-01-25). Must be set before the actual domain expiration date. If not specified, expiration will not be checked.
  • Severity (severity, default: Auto): Alert severity.