Start here
Before You Fix It: What This Check Means
A-record changes directly alter destination infrastructure for the host being monitored. In plain terms, this confirms whether your domain routing changed and needs a security/operations check. Scavo resolves current A records and compares them with the previous stored baseline.
Why this matters in practice: operational drift here often causes hard-to-debug regressions across environments.
How to use this result: treat this as directional evidence, not final truth. Registry and DNS states can change outside release cycles and may propagate asynchronously. First, confirm the issue in live output: confirm authoritative registrar or DNS provider records directly Then ship one controlled change: Compare authoritative DNS output with infrastructure source-of-truth. Finally, re-scan the same URL to confirm the result improves.
Background sources
TL;DR: Your domain now points to a different IP address than expected, which may indicate a hosting change or compromise.
DNS A record changes redirect your traffic to a different server. This is expected during hosting migrations, but an unexpected change could mean your domain has been compromised or your hosting provider changed infrastructure without notice. Monitor A record changes to catch problems before users experience downtime or are redirected to malicious servers.
What Scavo checks (plain English)
Scavo resolves current A records and compares them with the previous stored baseline.
Current logic:
Warning: domain cannot be derived from scanned URLWarning: no A records retrievedInfo: first successful run stores baselineWarning: A-record set changed from prior baselinePass: A-record set unchanged
How Scavo scores this check
Scavo assigns one result state for this check on the tested page:
- Pass: baseline signals for this check were found.
- Warning: partial coverage or risk signals were found and should be reviewed.
- Fail: required signals were missing or risky behavior was confirmed.
- Info: Scavo could not gather enough reliable evidence on this run to score pass/fail confidently.
In your scan report, this appears under What failed / What needs attention / What is working for dns_a_record_change, followed by Recommended next steps and Technical evidence (for developers) when needed.
- Scan key:
dns_a_record_change - Category:
TECHNICAL
Why fixing this matters
Unplanned A-record changes can reroute traffic, break uptime, or indicate unauthorized DNS edits.
Even planned changes deserve monitoring because propagation and misconfiguration issues are common during cutovers.
If you are not technical
- Confirm whether a DNS change was planned.
- If not planned, escalate immediately.
- Ask for before/after A-record values and change ticket.
- Re-run Scavo once records stabilize.
Technical handoff message
Copy and share this with your developer.
Scavo flagged DNS A record monitoring (dns_a_record_change). Please verify current A records against approved baseline, investigate unexpected deltas, and confirm intended origin routing. Share DNS evidence and re-run the scan.If you are technical
- Compare authoritative DNS output with infrastructure source-of-truth.
- Validate cutover intent and rollback readiness.
- Confirm TLS/certificate validity on new destinations.
- Lock down DNS edit permissions and enable audit logs.
- Monitor during propagation windows for mixed resolver results.
How to verify
- Query A records via authoritative and public resolvers.
- Confirm records match approved values.
- Confirm origin endpoints serve expected application.
- Re-run Scavo and confirm stable state.
What this scan cannot confirm
- It does not evaluate AAAA/CNAME in this specific check.
- It cannot infer business intent from technical deltas.
- DNS propagation can temporarily present mixed snapshots.
Owner checklist
- [ ] Assign owner for DNS change governance.
- [ ] Maintain approved A-record baseline.
- [ ] Require ticketed approvals for production DNS edits.
- [ ] Re-validate after registrar/DNS provider changes.
FAQ
Why is first run info?
Because Scavo needs a baseline before it can classify future changes.
Can planned migrations still warn?
Yes. Warnings indicate detected change, not whether it was authorized.
What if DNS lookup fails intermittently?
Scavo warns because it cannot produce a reliable comparison.
Do we need separate checks for subdomains?
Yes, scan each critical hostname you want monitored.
Sources
Need a DNS cutover runbook with rollback checkpoints? Send support your current and target records.
