Documentation

Checks

Every domain gets up to 33 monitors, one per enabled check type (SMTP and IPv6 only if the operator enables them). This chapter explains per type what is checked, which findings can arise and when they become an incident. At the end is the scoring of the public domain check.

On this page

Topics

How a check works

A monitor is a check type on a target (domain, host name or URL) with its own interval. Every run ends with a result: ok, warning, critical or error. An error means DomainWarn itself could not check (resolver timeout, time budget exceeded); it never changes an incident. Findings carry a severity: info, warning or critical, each with a text and a recommendation in German and English.

Only state findings open incidents, and only after their threshold: a fixed number of consecutive runs (1, 2 or 3) or, for availability checks, after the configured failure duration (default 5 minutes, converted into runs). Info findings never create an incident. Changes (a record differs from the last run) are events with before and after, are reported once and do not continue as an incident; details in "Alerts".

A run has 30 seconds. HTTP fetches follow at most five redirects and read at most 512 KB. DNS is queried preferably at the authoritative name server; every detected change is confirmed after 45 seconds against a second name server of the zone.

See also: Incidents, thresholds and reminders

Intervals per plan

Every monitor has an interval between one minute and seven days that you change in the settings of the domain. The plan sets the lower limit per check type; on a plan change intervals that are too short are raised. The most important lower limits:

  • Website (http): Free 15 minutes, Freelancer 5 minutes, Agency and Agency Pro 1 minute.
  • DNS records: Free 60 minutes, Freelancer 30 minutes, Agency 15 minutes. DNSSEC: Free 6 hours, Freelancer 1 hour, Agency 15 minutes.
  • SPF and DMARC: Free 6 hours, Freelancer 3 hours, Agency 1 hour. DKIM and MTA-STS: Free 12 hours, Freelancer 6 hours, Agency 1 hour. MX: Free 6 hours, Freelancer 1 hour, Agency 30 minutes.
  • Certificate: Free 12 hours, otherwise 6 hours. Blacklists: Free 24 hours, Freelancer 12, Agency 6 hours. Name servers: Free 24 hours, Freelancer 12, Agency 6 hours.
  • Registration, CT logs, redirects, CAA, BIMI and DANE: 24 hours on every plan. IPv6 and HTTP/3: 6 hours on Free, otherwise 1 hour (Agency Pro 30 minutes).

See also: Plan comparison

Frequently asked questions

Why do I see a finding but no incident?
Hints never create an incident, warnings only for state findings after their threshold. Some warnings deliberately have no incident, such as an SPF record with ptr, a SHA-1 certificate or a single unreachable MX host: they appear in the result and the timeline but wake nobody.
Can I switch off individual checks?
Yes, per domain the areas Website, Email and Domain & DNS, and every monitor individually. A switched-off monitor closes its open incidents without an all-clear.
Which checks need something from the client?
None. All checks read publicly queryable data: DNS, HTTP, TLS, RDAP, CT logs and blacklist responses. Nothing is installed at the client; only the records in one click need an integration with the DNS provider.
Why is the IPv6 or the SMTP monitor missing?
Both only exist if the operator has enabled them: IPv6 needs a checking server with IPv6 egress, the mail server check a release of port 25. Without port 25, DANE only checks form and signing of the TLSA records.