SSL, domain, DNS & schema

These four run on their own schedule, not on your check interval. A failure to look one of them up annotates the monitor — it never fails the monitor.

TLS certificates

Read once a day, straight off the connection. We record the expiry date and the issuer, and warn at 30, 14, 7, 3 and 1 days — once per threshold, not once per day.

An expired certificate is the most preventable outage there is, and it still happens to somebody every week.

Domain registration

Read once a day over RDAP, the modern replacement for WHOIS. Same warning thresholds. Losing a domain to a lapsed renewal is rarer and far worse than a lapsed certificate.

DNS changes

Every hour we resolve your A, AAAA, NS, MX and CNAME records, sort them, and hash the result. When the hash changes you get an alert naming exactly what was added and removed.

If you made the change, ignore it. If you did not, you want to know inside the hour.

Response schema

Turn this on for JSON endpoints. We hash the shape of the response — the key paths and the type of each value — and ignore the values themselves. A counter ticking over is silent; a field appearing, disappearing or changing type is an alert.

{"id": 1, "total": 42.0, "user": {"name": "Ada"}}
→ id:int, total:float, user.name:str

{"id": 2, "total": "42.00", "user": {"name": "Grace"}}
→ id:int, total:str, user.name:str        ← alert: total changed type

This catches the failure where your API still returns 200 and a client has silently broken.