Integrations
DomainWarn reads publicly what it checks and needs no access for that. For everything beyond there are integrations: DNS providers for import and one-click records, chat tools for alerts and commands, extensions for WordPress, Shopware and Chrome, calendar, API, CSV and n8n for your own workflows.
Connect the account, import zones, create missing DMARC, SPF, TLS-RPT and CAA records straight from the finding, set a permissive SPF ending to ~all, add the issuing CA to the CAA set. DomainWarn changes existing records only after explicit confirmation, never deletes anything, and only writes if all name servers of the domain point to the provider. Credentials are stored encrypted, verified for write access on save (at netcup only the login; the credentials cover the whole account) and never shown again.
An API token from the "Edit zone DNS" template with the permissions Zone:DNS:Edit and Zone:Zone:Read, limited to the zones of the clients DomainWarn may write to. The token can be revoked in Cloudflare at any time.
*.ns.cloudflare.com.An API token of the project in the Hetzner Console with permission "Read & Write"; a read-only token is rejected. Hetzner tokens cannot be limited to DNS, the token may do anything in the project. Therefore create a dedicated project for DNS zones only and delete the token there whenever needed.
*.ns.hetzner.com and *.ns.hetzner.de.An API key from the IONOS Developer Portal, consisting of public prefix and secret, which IONOS shows only once. The key covers every zone of the account and cannot be limited to single zones or to DNS: a dedicated key for DomainWarn only, deletable in the portal at any time.
*.ui-dns.com, .de, .org, .biz).Customer number, Legacy API key and Legacy API password from the Customer Control Panel under Master data → API (not the login password). netcup has no per-zone permissions: the API key may change every DNS zone of the account; DomainWarn only adds missing records.
*.netcup.net) using classic DNS; CloudDNS has its own API and is not supported yet.Username and password of an INWX sub-account that only has the "DNS management" (name server) role, no domain, contract or account permissions. Two-factor authentication must be off for the sub-account because the API cannot log in without a TAN; the sub-account can be locked or deleted in the customer centre at any time.
ns.inwx.de, ns2.inwx.de, ns3.inwx.eu and the .com/.net variants)._domainwarn-verify-… in the first zone and deletes it again.Application key, application secret and consumer key from the createToken page of the account’s region (Europe, Canada or USA). The consumer key only gets the rights GET /domain/zone plus GET, POST, PUT and DELETE on /domain/zone/* – domains, servers and invoices stay out of reach. The key can be revoked at any time through the OVHcloud API.
dnsNN.ovh.net/nsNN.ovh.net, .anycast.me with DNS Anycast, .ovh.ca in Canada, .ovh.us at OVHcloud US).Access key ID and secret access key of a dedicated IAM user without console access. The inline policy allows only route53:ListHostedZones, route53:ListHostedZonesByName, route53:ListResourceRecordSets and route53:ChangeResourceRecordSets, the latter two ideally restricted to the hosted zones DomainWarn may write to.
ns-….awsdns-….com/.net/.org/.co.uk).route53domains:ListDomains: auto-renewal, transfer lock and expiry date of the domains registered with Route 53; with auto-renewal on, DomainWarn only warns one week before expiry.A token from desec.io/tokens. Without a policy it may change every domain of the account; recommended is a default policy without write access plus, for each domain DomainWarn should manage, a policy with write access. DomainWarn needs no permission to create or delete domains or to manage tokens.
ns1.desec.io, ns2.desec.org)._domainwarn-verify-… and deletes it again.User and password of a dedicated autoDNS user that may only view and edit zones, plus the context (4 for the live system, your own number for PersonalAutoDNS). Two-factor authentication must be off for this user because the API cannot log in without a one-time code; you can lock or delete the user in autoDNS at any time.
a.ns14.net to d.ns14.net, any1/any2.ns14.net, nsa to nsd.domain-robot.org)._domainwarn-verify-… in the first zone and deletes it again.Alerts go to 20 channel types; Slack and Microsoft Teams additionally respond to commands.
A slash command in Slack or an outgoing webhook in Teams, secured with the signing secret or an HMAC token. /domainwarn client.com shows state, certificate days left, domain expiry and open incidents with a link to the dashboard; check client.com triggers a check; list shows all domains needing action, visible only to you. Replies come in the language of the organization.
Recommended: email, Slack, Microsoft Teams, Discord, webhook with HMAC signature. On-call: PagerDuty and Opsgenie with automatic close on the all-clear, Pushover, ntfy, SMS, web push. More: Telegram, Google Chat, Mattermost, Rocket.Chat, Zulip, Matrix, Gotify, private Atom feed and your own SMTP server. Every channel has a minimum severity, every channel is confirmed by a test delivery.
What nobody sees from outside: the exact version, extensions with a pending update, the mail setup – and whether scheduled tasks still run. Plus the domain check in one click in the browser.
The plugin takes the addresses of the site into monitoring and reports every 15 minutes what stays invisible from outside: WordPress and PHP version, plugins and themes with a pending update, sender address and mail server, maintenance mode. Plus a heartbeat – if it stops, WP-Cron has stalled while the site still answers perfectly.
Setting it up takes one click: “Connect with DomainWarn” opens the confirmation page, and the token lands on the site by itself. Nothing to copy, no slug.
The same inside view for Shopware 6: Shopware and PHP version, installed extensions with a pending update, the mail setup, plus the domains of the sales channels. The shop admin shows the state of every domain with its open incidents under Settings, without switching to the dashboard.
Connecting takes one click here as well: “Connect with DomainWarn”, confirm, and the token reaches the shop server to server.
One click on the icon checks the domain of the current page with the same twenty checks as the domain check, from certificate, IPv6, HTTP/3 and security.txt to name servers, CAA, BIMI and blacklists: a score per area and overall, the open points sorted by what fixing them earns. Works without an account.
At the top of the popup you can pick any single check instead of the overall one; every open point leads to the full result on the website. After "Sign in with DomainWarn" the popup also shows whether the domain is monitored, its state and open incidents, and adds it if you like. The extension only needs the address of the active tab and does not run in the background.
Expiry dates, domain lists and incidents in your own tools and workflows.
One ICS address per organization with an all-day event per domain expiry and per certificate expiry, with client, registrar or issuer, link to the dashboard and reminders 14 and 3 days ahead. Add it as a subscription by URL; calendar apps refresh every 12 hours. The address can be renewed or switched off at any time.
Everything from the dashboard via API: create domains and clients, trigger checks, acknowledge incidents, query events and check results. Tokens with read or write scope, 300 requests per minute, errors as application/problem+json, specification at /openapi.json for Postman, Insomnia or generated clients.
The domain list with the current filters as CSV: domain, client, state, CMS, registrar, domain expiry, certificate valid until and days left, open incidents, last check. UTF-8 with BOM, semicolon or comma, protected against formula injection, also available via API token.
The DomainWarn trigger starts a workflow as soon as an incident opens, escalates or resolves, a certificate or domain is about to expire or a DNS record changes. When you activate the workflow it creates the signed webhook in DomainWarn by itself and removes it again on deactivation; every delivery is verified by its HMAC signature.
The DomainWarn node does the rest inside the workflow: list, create, pause and resume domains, check all monitors of a domain right away, list and acknowledge incidents, and run any of the free checks for any domain. Install the package n8n-nodes-domainwarn under Settings → Community nodes.
You set up integrations in the dashboard under Settings → Integrations, with a step-by-step guide per provider. Included in every plan.