Documentation

Alerts

One incident instead of one mail per check, one all-clear instead of ten, changes with before and after: this chapter describes which alerts DomainWarn produces, where they go and how you set thresholds, quiet hours and the digest.

On this page

Channels

You set up channels under Settings → Notifications (owners and admins). They apply to the whole organization: every alert goes to all active channels whose minimum severity it reaches. The minimum severity per channel (info, warning, critical; default warning) is the filter; SMS only ever go for critical. Twenty channel types are available, in three groups:

  • Recommended: email (all members with the role owner, admin or member plus up to 20 fixed addresses), Slack, Microsoft Teams, Discord and signed webhooks.
  • On-call: PagerDuty and Opsgenie (alert on open, automatic close on the all-clear), Pushover, ntfy, SMS and web push (per member and device).
  • More: Telegram, Google Chat, Mattermost, Rocket.Chat, Zulip, Matrix, Gotify, a private Atom feed with the last 50 events and your own SMTP server for mails with your sender address.
  • Test delivery is mandatory: a channel only counts as confirmed once a test has arrived; after every configuration change the confirmation is reset. If delivery fails three times in a row, the channel counts as broken, is no longer served, and the members learn about it by email.
  • Webhook: HTTPS address, the secret is shown once. Every delivery carries X-DomainWarn-Signature: sha256=<HMAC-SHA256(secret, timestamp + "." + body)>, X-DomainWarn-Timestamp and X-DomainWarn-Event; the JSON body contains kind, severity, title, message, url and data with incident ID, domain, type and, for changes, before/after.
  • SMS: confirm the number with a code (valid 10 minutes, five attempts), 160 characters with title, domain and link. Monthly quota per plan (Freelancer 20, Agency 100, Agency Pro 300); once it is used up there is one notice mail, further SMS are dropped.
  • Limits: 2 channels on Free, 5 on Freelancer, 10 on Agency, 25 on Agency Pro. At most 30 deliveries per minute and channel.

Incidents

An incident is a state with a lifetime: it opens when a state finding reaches its threshold, stays open as long as the finding is confirmed on every run, and closes when the recovery is confirmed. Per monitor and incident type there is at most one open incident, which is why an outage lasting hours produces one alert and not a hundred.

  • Thresholds: availability checks (website, IPv6) after the failure duration from the rules (default 5 minutes, overridable per domain), converted into consecutive runs; configuration checks after a fixed number of runs, mostly 1 or 2, "slow" after 3. Which threshold applies to which finding is in the Checks chapter.
  • Alert window: openings are collected for 60 seconds. One or two incidents are reported individually; from three at once a summary alert is created ("N incidents opened at the same time"), for example when a hosting provider goes down.
  • Escalation: if the severity rises within an open incident (warning becomes critical), the incident is updated and reported again exactly once.
  • Acknowledge: an acknowledged incident stays open but receives no more reminders. Owners, admins and members may acknowledge; the name is shown on the incident, not visible to client access.
  • Recovery: after the recovery duration (default 2 minutes, for availability checks at least two clean runs, otherwise at least one) the incident is closed and exactly one all-clear with the duration is sent, regardless of the minimum severity of the channel. If a monitor is switched off or paused, the incident closes without an all-clear.
  • Domain state: the highest severity of its open incidents. Incidents are never deleted; events are kept for 12 months, raw results 7 to 90 days depending on the plan.

See also: Thresholds per check type

Reminders and quiet hours

Open, unacknowledged incidents are brought back to mind after 1 hour, 6 hours, 24 hours and then daily, at most seven times; you set the number in the rules, and reminders can be switched off entirely. Via the API a custom schedule is possible (reminder_schedule, e.g. 30m,2h,daily). Reminders go to the same channels as the opening.

Quiet hours (from/to in the time zone of the organization, also across midnight) hold back warnings and hints. Critical alerts always go through, as do alerts for domains with "ignore quiet hours". A warning opened during quiet hours is delivered after they end, provided the incident is still open and unacknowledged; reminders from quiet hours are dropped. Digest and test delivery know no quiet hours.

Change alerts

Every run compares the canonicalised state (without TTL, order and letter case) with the previous one. A difference is confirmed after 45 seconds against a second authoritative name server and then stored as an event with before and after and reported once; it does not create an incident. On the first run of a domain only the baseline is established.

  • Groups in the rules: MX, name servers, SPF, DMARC, certificate, DNS records, website, registration, DKIM, DNSSEC, MTA-STS, blacklist and CT logs. By default all are on except "DNS records" (single A, AAAA, CNAME and TXT changes), which only land in the timeline.
  • Critical changes: SPF record removed, DMARC policy weakened, STARTTLS gone, MX removed (plus incident "no MX"), blacklist listing, certificate for an unknown host name shortly after a DNS change.
  • Anti-flapping: if the DNS state of a domain changes more than six times a day (round robin, geo DNS), A and AAAA changes count as volatile and are only logged.

Rules per organization and per domain

The rules under Settings → Notifications apply to all domains: failure duration and recovery duration (1 to 1440 minutes), minimum severity, reminders, change groups, quiet hours and digest. Per domain you can override failure duration, minimum severity and "ignore quiet hours" in the settings of the domain, e.g. one minute of failure duration for the shop and 30 minutes for the staging site. Channels cannot be assigned per domain or client; every alert names client and domain so it can be filtered in the chat.

Daily or weekly digest

The digest summarises per organization what is open and what has changed: daily, weekly on a weekday or off, at a time in the time zone of the organization (default 08:00). It contains the number of monitored domains with healthy/warning/critical, "Action needed" with the open incidents (critical first, including expiring certificates and domains, up to 25), the changes of the period (up to 40, without maintenance windows) and, for the weekly, the number of resolved incidents. It goes as an info alert to all active channels regardless of their minimum severity; SMS and the Atom feed do not receive it. Whether it also arrives when there is nothing to report is your setting.

Maintenance windows

Under Settings → Maintenance windows you create one-off (from/to) or weekly windows (weekdays, time from/to, time zone), for all domains, one client or one domain. During a window the checks keep running, but no incidents are opened, no escalations and no changes are reported; changes land marked in the timeline and are missing from digest, feed and monthly report. The recovery of open incidents is still detected. Owners, admins and members may create them; the domain page shows an active window as a notice.

Distinct from that is pausing a domain until a point in time: then no checks run, and the status page shows "maintenance".

Slack and Teams commands

Under Settings → Notifications → Chat commands you create up to ten commands (owners and admins): provider Slack or Teams, name and secret; the card shows the callback address, the call counter and the last use.

  • /domainwarn client.com: state with traffic light, certificate "N days left", domain expiry, up to five open incidents with "since", last check and dashboard link; visible to the channel.
  • /domainwarn check client.com: triggers all active monitors, at most three times per domain in five minutes; the "Check now" quotas apply.
  • /domainwarn list (also status): "Action needed (N of M domains)" with up to 15 domains, critical first, visible only to you.
  • /domainwarn help: overview of the commands.
  • Permissions apply per workspace, not per user: whoever may run the command sees all domains of the organization. Invalid signatures get 404; 30 calls per minute and command.
  1. Slack: create an app at api.slack.com/apps, a slash command /domainwarn with the callback address as request URL, and enter the app's signing secret as the secret in DomainWarn. Requests are verified with the Slack signature and a timestamp at most five minutes old.
  2. Teams: first create the command with a placeholder secret, copy the address, in the team under "Manage apps" create an outgoing webhook "DomainWarn" with this callback address and afterwards enter the displayed security token as the secret. Invoke by mention: @DomainWarn client.com.

Commands and replies in the language of the organization:

When DomainWarn itself has a problem

DomainWarn checks reference targets every minute. If more than half of them fail, the checking service itself counts as disturbed: openings are suspended, reminders and escalations are deferred and delivered after the end, provided the incident is still open. That way a network problem in the data centre does not produce a wave of false outage alerts.

Frequently asked questions

Do I get a mail for every check?
No. There is one alert when an incident opens, reminders on schedule as long as it is unacknowledged, and exactly one all-clear. Simultaneous openings are combined into a summary alert.
Can a client get their own Slack channel?
Channels apply to the whole organization and cannot be restricted to one client. For clients there are the public status page, client access and the monthly report; every alert names the client so it can be filtered in the chat.
Why did an alert arrive despite quiet hours?
Critical alerts and all-clears are not subject to quiet hours, nor are domains with "ignore quiet hours" and the digest.
Can I close an incident by hand?
No, incidents close when the check confirms the recovery, or when the monitor is switched off. Acknowledging suppresses the reminders until it is fine again.