Track DNS Record Changes on Windows DNS

When a DNS record changes unexpectedly, the most useful evidence comes from auditing that was enabled before the incident. Windows DNS data may be Active Directory-integrated, so both DNS diagnostics and directory auditing can matter.

Practical investigation

1. Confirm the current record and TTL with Resolve-DnsName or Get-DnsServerResourceRecord.
2. Identify whether the zone is AD-integrated and which DNS servers host it.
3. Review the DNS Server event logs and any analytical/audit logging your organisation has enabled.
4. For AD-integrated zones, correlate relevant Directory Service auditing with the approximate change time.
5. Check automation systems, DHCP dynamic updates and IPAM/DNS management tools before assuming a user changed the record manually.

Improve future traceability

• Use named admin accounts rather than shared credentials.
• Restrict who can modify zones/records.
• Forward DNS and security audit events to a central log platform with adequate retention.
• Document legitimate automated updaters so their changes can be distinguished from unexpected activity.

Do not enable extremely verbose diagnostic logging indefinitely without checking storage and performance impact.