Alert – Your DNS records have changed

  • Resolved stevespeirs

    (@stevespeirs)


    6 years ago

    Just received a “Your DNS records have changed” alert on the WordFence dashboard (see below). I haven’t updated CNAME records, DNS records are the same and it doesn’t look like I’ve been hacked. The only recent change made was updating the WordPress and Site URL under General Settings in the WordPress dashboard. Would this be the trigger for the WordFence alert? Loving the plugin. Keep up the great work!

    Old DNS Records: https://www.example.com points to example.com
    New DNS Records:

    Details: We have detected a change in the CNAME records of your DNS configuration for the domain runbulldogrun.com. A CNAME record is an alias that is used to point a domain name to another domain name. For example foo.example.com can point to bar.example.com which then points to an IP address of 10.1.1.1. A change in your DNS records may indicate that a hacker has hacked into your DNS administration system and has pointed your email or website to their own server for malicious purposes. It could also indicate that your domain has expired. If you made this change yourself you can mark it ‘resolved’ and safely ignore it.

    The page I need help with: [log in to see the link]

Viewing 5 replies - 1 through 5 (of 5 total)
  • wfdave

    (@wfdave)

    Hi @stevespeirs,

    The changes you made within WordPress would not have triggered this message.

    This warning is a result of your domain records being changed.

    I looked up CNAME records for your website at runbulldogrun.com, and none were listed.

    That means, at one point in time, there was a record that existed, but it was removed.

    I would recommend contacting HostGator, or the provider that manages your DNS to ask, “Was there a CNAME record before?”

    Dave

    Thread Starter stevespeirs

    (@stevespeirs)

    Thanks, Dave!

    Thread Starter stevespeirs

    (@stevespeirs)

    That’s strange – I’m not seeing the alert on the WordFence dashboard or in the log files now….

    wfdave

    (@wfdave)

    Hi again,

    That is strange, the logs are stored within your database. Is it possible that HostGator, or someone else cleared a table within the database?

    Dave

    Hi, I received the similar alert…My DNS records changed (below). I have some screens I can email to show what i found on the HG DNS settings but wonder if this is a false positive or should i be concerned and what i should do? Please let me know. Thanks! Chris:

    Old DNS Records: mail.gogreenandhealthypets.com
    New DNS Records: ALT1.ASPMX.L.GOOGLE.com, ALT2.ASPMX.L.GOOGLE.com, ASPMX.L.GOOGLE.com, ASPMX2.GOOGLEMAIL.com, ASPMX3.GOOGLEMAIL.com
    Details: We have detected a change in the email server (MX) records of your DNS configuration for the domain gogreenandhealthypets.com. A change in your DNS records may indicate that a hacker has hacked into your DNS administration system and has pointed your email or website to their own server for malicious purposes. It could also indicate that your domain has expired. If you made this change yourself you can mark it ‘resolved’ and safely ignore it.

Viewing 5 replies - 1 through 5 (of 5 total)
  • The topic ‘Alert – Your DNS records have changed’ is closed to new replies.