Domain monitoring isn’t glamorous, but it’s the difference between catching a blacklisting in 10 minutes versus discovering it when customers complain their emails are bouncing. Here are the five things worth monitoring continuously.
1. Domain Expiry
The most preventable problem. A domain that expires takes your website, email, and every service tied to it offline simultaneously.
What to track:
- Expiry date from WHOIS/RDAP
- Days until expiry
- Auto-renewal status at your registrar
Warning thresholds:
- 90 days → confirm renewal is scheduled
- 30 days → verify auto-renewal will process
- 7 days → manual action if auto-renewal hasn’t fired
How to check: DomainScan’s domain lookup shows expiry date and days remaining under the Registration tab.
Prevention: Enable auto-renewal at your registrar and keep payment methods current. Many registrars send expiry notices to the registrant email — ensure that inbox is monitored. Set independent calendar reminders as a backup.
2. SSL Certificate Validity and Expiry
An expired SSL certificate shows a browser security warning that blocks visitors. Certificate expiry is completely predictable, yet it still takes down production sites regularly.
What to track:
- Certificate expiry date
- Days until expiry
- Certificate validity (not revoked)
- Trust chain integrity (intermediate certificates installed correctly)
- Protocol version support (TLS 1.2+ only)
Warning thresholds:
- 30 days → schedule renewal
- 14 days → renew immediately if not on auto-renewal
- 7 days → critical — manual action now
- Expired → site is inaccessible to most users
How to check: DomainScan’s SSL checker shows expiry date, issuer, trust chain status, and security configuration grade.
Common cause of unexpected expiry: Let’s Encrypt certificates auto-renew via certbot/ACME — but the renewal process can silently fail if the domain’s A record changes, ports are blocked by firewall, or the certbot cron job is disabled.
Check the cert on each subdomain separately — a wildcard cert or a multi-SAN cert might renew but not be deployed to all services.
3. Blacklist Status
A blacklist listing silently filters or rejects your email without notifying you. You may not know for days — until users report undelivered messages or partners stop receiving your emails.
What to track:
- IP reputation lists (Spamhaus ZEN, Barracuda BRBL, SpamCop)
- Domain reputation lists (Spamhaus DBL, SURBL)
- Phishing/malware databases (Google Safe Browsing, PhishTank)
Response time: Blacklistings should trigger an alert within minutes, not hours. Each hour of delay means more email filtered and more damage to your sending reputation.
How to check: DomainScan’s Trust Score checker queries 130+ blacklists and returns results in seconds.
What to do when listed: See how to check domain blacklists for the full diagnosis and removal workflow.
4. DNS Record Integrity
DNS changes are instant. Unauthorized changes — whether from account compromise, registrar error, or DNS hijacking — can redirect your traffic, break email, or enable man-in-the-middle attacks.
What to track:
- A and AAAA records (do they still point to your servers?)
- MX records (do they still point to your mail provider?)
- NS records (are nameservers still your intended provider?)
- TXT records for SPF/DMARC (have they been modified?)
Detect changes by baselining: Take a DNS snapshot when everything is working correctly. Compare current records against the baseline periodically.
How to snapshot: Run DomainScan’s DNS query on your domain with “All Types” selected and save the output as your baseline. Repeat weekly and compare.
Unusual signs of DNS hijacking:
- Your site is “down” but your server appears normal
- Users get SSL certificate errors for your domain
- Email is delivering to the wrong server
- NS records changed without your knowledge
5. Email Authentication Drift
Email authentication breaks gradually. You add a new email service, forget to update SPF. A DKIM key rotates. DMARC reports start showing failures you didn’t notice.
What to track:
- SPF record lookup count (must stay under 10)
- SPF coverage (do all sending services have include: entries?)
- DKIM selectors (are keys current and not expired?)
- DMARC policy (has someone weakened it from
p=rejecttop=none?) - DMARC alignment rate (what % of email is passing?)
How to check: DomainScan’s email authentication checker shows SPF, DKIM, DMARC, MTA-STS, BIMI, and TLS-RPT in a single view with a deliverability score.
Signs of auth drift:
- Email to Gmail or Microsoft 365 starts landing in spam
- DMARC aggregate reports show increasing failure rates
- A new sending service isn’t appearing in DMARC pass reports
Building a Monitoring Routine
Monthly Manual Checks (10 minutes)
Run these for all domains you control:
- Trust Score check — catches blacklists, SSL issues, DNS problems
- SSL expiry check — confirm 60+ days remaining
- WHOIS lookup — confirm expiry date and auto-renewal status
- Email auth check — confirm SPF/DKIM/DMARC all passing
Alerts to Set Up
| Alert | Trigger | Action |
|---|---|---|
| Domain expiry | 90 days, 30 days, 7 days | Confirm renewal |
| SSL expiry | 30 days, 14 days, 7 days | Renew certificate |
| Blacklist listing | Immediately on detection | Diagnose and request removal |
| DNS change | Any unauthorized record modification | Investigate immediately |
| DMARC failure rate spike | >10% failure rate over baseline | Check for new sending service or SPF drift |
What to Do After Any Domain Change
After any change to DNS records, email providers, or SSL certificates:
- Run a DNS propagation check to confirm the change is live globally
- Run DomainScan Trust Score to confirm overall health
- Send a test email to a Gmail/Outlook account and check headers for authentication results
- Check the SSL cert on the affected hostname
Treat every DNS change as a potential incident until you’ve verified it resolved correctly. Most domain outages are self-inflicted during changes that seemed routine.
Priority Order: What Breaks Business First
| Issue | Business Impact | Detection Difficulty |
|---|---|---|
| Domain expiry | Catastrophic — full outage | Easy — predictable date |
| SSL expiry | High — browser blocks visitors | Easy — predictable date |
| Critical blacklisting | High — email delivery halted | Hard — silent, no notification |
| DNS hijacking | Severe — traffic redirected | Hard — may look like outage |
| Email auth drift | Medium — spam filtering increases | Hard — gradual degradation |
| Minor blacklisting | Low — some delivery impact | Medium — check reports |
The hardest issues to catch (blacklisting, auth drift) benefit most from automated monitoring. The predictable issues (expiry) just need calendar reminders and auto-renewal enabled.
Common Questions
How often should I check my domain's health?
For production domains, automated monitoring with alerts is far better than periodic manual checks. Blacklisting can happen within hours. SSL expiry is predictable but still catches teams off guard. DNS changes can happen instantly. At minimum, check manually monthly. For business-critical domains, set up monitoring that alerts within minutes.
What's the most common domain problem that goes unnoticed?
SSL certificate expiry is the most common — it's entirely predictable but still takes down sites because nobody tracked the expiry date. Second is email deliverability degradation from DMARC/SPF drift (adding a new sending service but forgetting to update SPF). Third is blacklisting, which can silently filter email for days before someone notices.
Can my DNS records be changed without my knowledge?
Yes. DNS hijacking happens through registrar account compromise, nameserver vulnerabilities, or BGP hijacking at the network level. Signs include users reporting site unavailability or certificate errors while your server appears normal. Regular DNS record snapshots let you detect unauthorized changes by comparing current records to your baseline.
My domain is expiring soon. What happens if I don't renew?
Immediately after expiry: the domain stops resolving — your website and email go dark. After a grace period (usually 30–45 days): it enters redemption status, still recoverable but with a high redemption fee. After redemption: it's released for general registration and anyone can buy it. Set renewal reminders well in advance — at least 60 days before expiry.