DNS Watchdog scans every record across your DNS providers for takeovers, exposed services, expiring certificates and broken email authentication. It also searches the web for lookalike domains trading on your brands and ranks each one by risk. Read-only access, nothing to install.
Not ready to talk? Get a free report on your domain
Two of these attacks ran on subdomains their owners had forgotten to clean up. The third ran on copycat shops whose domains carried the brand's own name, sitting in search results where shoppers found them. Both were there to be found by anyone who looked.
An ongoing threat-actor campaign tracked by Infoblox has taken control of forgotten subdomains at Bose, Panasonic, Deloitte, the US Centers for Disease Control, and more than 34 universities including Berkeley and Columbia, serving malware, fake antivirus warnings, and tech-support scams from domains users already trust.
TechRadar · Infoblox researchAfter Russell & Bromley went into administration in January 2026, clone shops on domains such as russellbromleyonlineuk and russell-and-bromley offered 80% off every style as a final goodbye sale. Customers who ordered never received their goods. The shops sat in search indexes long enough for ChatGPT to recommend them, while Next, the brand's new owner, worked to get them taken down.
TheIndustry.fashion · Ask Silver researchA single forgotten DNS record (saostatic.uber.com pointing to an unregistered CloudFront distribution) put Uber's single sign-on at risk. Because cookies were shared across *.uber.com, one subdomain takeover would have unlocked session hijack on every Uber property. A researcher caught it, and it still took Uber two months to patch.
ZDNet · Arne Swinnen disclosureGive us a domain and we'll scan it from the outside, the way an attacker would find it, with no access to your DNS providers. We go through what the scan turns up and send you a PDF of the issues worth fixing first.
Every hostname is screenshotted automatically, so takeover pages, brand misuse, and unexpected applications are easy to spot. Each screenshot links back to the originating record.
Headless Chromium renders each page exactly as a visitor's browser would, JavaScript and redirects included, and stores a full-size screenshot.
Each screenshot is fingerprinted with a perceptual hash, so identical and near-identical pages collapse into a single entry. A parked-domain template that appears on forty hostnames only needs reviewing once.
Hostnames that redirect to the same destination are grouped together, so you review each distinct surface once rather than hundreds of rows of the same landing page.
Lookalike domains never touch your infrastructure, so the rest of your tooling never sees them. DNS Watchdog searches the web for domains carrying your brand names, reads what each one serves, and hands you a short queue ranked by risk.
Each brand is searched on the web for domains that contain its name, character swaps included. Domains you own are left out, and you can add suspects by hand.
An AI model reads each live page and scores it from 0 to 100 for impersonation, commercial exploitation and malicious intent, naming threats such as phishing, counterfeit goods and affiliate abuse.
Watch, flag, raise a Jira ticket or ignore with a reason. Findings sit beside your DNS issues, and a Brand Protection role gives your brand team the findings without your DNS.
Posts on DNS security and running a DNS portfolio, from the team building DNS Watchdog.
A complete reference to the 38 ports we check on every resolved IP, grouped by the severity we assign when one is open - and how each one lands in a real-world breach.
An SPF record ending in `+all` means any server on the internet can send mail claiming to be you. Here's why it's still on production domains in 2026, and how DNS Watchdog catches it.
A walkthrough of a real dangling CNAME - how to spot one manually, why they're so easy to miss in a large estate, and what attackers do with them once they find one.
How years of DNS drift create hidden security exposure - and why continuous monitoring is critical to preventing subdomain takeover and misconfiguration breaches.
Everything buyers ask us before they book a demo. Missing something? Drop us a note.
DNS Watchdog has native integrations for AWS Route 53, Cloudflare, Google Cloud DNS, Azure DNS, CSC Domain Manager, and Vercara UltraDNS. If you need another provider, get in touch and we'll scope it.
No. DNS Watchdog connects with read-only credentials and never modifies your DNS. It continuously inventories and grades your estate and detects changes made at your provider, but it never makes changes itself. When you fix a finding at your provider, DNS Watchdog closes it on the next scan.
Under ten minutes for most customers. Connect a provider (paste IAM or API credentials), zones auto-discover in a couple of minutes, and your first scan completes in another few, with its findings waiting in the app. That first scan is your baseline, so notifications start with what changes after it.
Every record in every connected zone is scanned daily by default, and you can trigger an on-demand rescan at any time. After you fix something at your provider, a rescan closes the finding without waiting for the next daily cycle.
Domains that contain your brand names, including character swaps such as acm3-outlet.com for Acme, found by searching the web and from domains you add yourself. Each live page is scored from 0 to 100 for impersonation, commercial exploitation and malicious intent, and the domains you are watching are re-checked every day, so a parked name that goes live is caught.
No. DNS Watchdog finds and documents them: each finding carries the fetched page, a screenshot, the redirect chain and the model's reasoning, and can be raised as a Jira ticket in one click. Filing the takedown with the registrar or host stays with you or your takedown provider.
Yes. The Brand Protection role sees brand findings and nothing else. It can triage, export and raise Jira tickets, but it cannot see your zones, records or DNS issues.
The Security Grade turns every finding into one score with a history, and the Executive Report emails a two-page PDF of it, weekly or monthly, to up to ten people: the grade and its trend, open issues by severity, and a plain-language posture board. Recipients don't need an account.
DNS Watchdog runs on AWS in the UK. DNS provider credentials are encrypted at rest with AWS KMS in SSM Parameter Store, accessed only to perform the scans you've configured. Full details are in our Data Protection Policy.
DNS Watchdog finds both first. Connect your providers in minutes for continuous scanning of every record, and a daily watch for lookalike domains trading on your brands.
Not ready to talk? Get a free report on your domain