A surprising number of high-severity incidents are not caused by code. They come from operational drift:
- domain renewals missed,
- nameserver changes no one approved,
- A-record changes with no change ticket.
The good news is these are preventable with simple controls and ownership.
1) Domain expiry: treat as critical infrastructure
A domain expiry event is not "just billing." It is a service-availability incident.
Minimum controls:
- Auto-renew enabled
- Valid payment method
- Multiple renewal contacts (not one person)
- Quarterly registrar access review
2) Nameserver changes: treat as control-plane events
Nameserver changes reroute DNS authority. That should always be intentional, approved, and auditable.
Minimum controls:
- MFA on registrar account
- Least-privilege access
- Change approval process for NS updates
- Baseline record of approved nameserver set
3) A-record changes: treat as origin routing events
A-record changes can be valid during migrations, but surprise changes should trigger immediate review.
Minimum controls:
- Document approved target IPs
- Log every DNS change with timestamp + owner
- Validate propagation after planned changes
Incident response pattern
When drift is detected:
- Confirm if change was planned.
- If not planned, treat it as a security and availability incident.
- Roll back to approved baseline where safe.
- Rotate credentials and audit access scope.
Owner checklist
- [ ] Registrar, DNS, and incident contacts are current and shared (not single-owner only).
- [ ] NS and A-record baselines are documented and versioned.
- [ ] Any DNS/registrar change requires approval and post-change validation.
- [ ] Quarterly resilience review includes domain and DNS controls.
Where Scavo helps
Scavo monitors domain expiry windows, nameserver changes, and A-record drift so teams can catch control-plane problems before they become outages.
These checks are especially valuable because they cover risks normal app-level tests never see.
Sources
What to do next in Scavo
- Run a fresh scan on your main domain.
- Open the matching help guide in
/help, assign an owner, and ship the smallest safe fix. - Re-scan after deployment and confirm the trend is moving in the right direction.
