DNS monitoring + DNSSEC + SPF/DKIM/DMARC watcher

XICTRAQ monitors all common record types: A, AAAA, CNAME, MX, TXT, NS, SOA, SRV and CAA. Each record type is tracked individually, so you can see exactly which entry changed.

By default, you receive warnings at 30 and 7 days before expiry. Many domains expire accidentally because credit card details at the registrar are outdated. This requires the registry to publish an expiry date: the date comes from the public registry record (RDAP), and each zone decides for itself. Generic endings such as .com or .org publish it, .de domains have none at all (the allocation is open-ended), .at runs no public lookup, .ch and .li answer without a date. XICTRAQ then shows the reason instead of inventing a deadline — and treats a missing date as harmless only for .de.

DNS hijacking occurs when attackers change your DNS records to redirect traffic to malicious servers. XICTRAQ records every change to A, AAAA and NS records at the next check interval in the changelog, with old and new values, and flags it as a warning.

These email authentication protocols prevent attackers from sending emails in your name (spoofing). Without correct SPF, DKIM and DMARC entries, your emails are more likely to end up in spam and your domain is vulnerable to phishing attacks.

DNS records are checked every 6 hours on paid plans and every 24 hours on the Free plan. The registry record (RDAP) is queried once daily, as registration information changes less frequently. Alerts such as a changed CAA lock or an approaching expiry go out right after the check that detects them.

Yes. Each subdomain can be monitored as a separate website, within the website limit of your plan. XICTRAQ can also automatically discover known subdomains via Certificate Transparency logs (crt.sh) and suggest them for monitoring.

Often yes — and that is the strength of the Certificate Transparency watch (from the Business plan). Before a phishing page goes live, attackers usually request a TLS certificate so the padlock appears in the browser. Every publicly trusted certificate is recorded in the Certificate Transparency logs. XICTRAQ evaluates these logs (technical source: crt.sh) daily and matches new certificates against your brand, look-alike variants and brand keywords. This often surfaces a suspicious domain hours to days before it resolves in DNS — that is, before the actual phishing campaign starts. It cannot promise gap-free protection, because attackers could in theory skip a certificate; in practice, however, the CT watch is a very early warning signal.