Domain checks
Every 6 hours, Spectate looks up each domain at its registry and compares the result with the last lookup. This page lists the alerts that a lookup can fire, their severities, and the settings that control them. Domain monitoring explains how the lookup works.
Alerts
| Alert | Severity | Fires when | Setting |
|---|---|---|---|
Domain example.com expires soon | Medium | The expiry date is within the threshold. The default threshold is 30 days. | Warn before expiry |
Domain example.com has expired | Critical | The expiry date is in the past. | Always on |
Domain example.com is no longer registered | Critical | The registry has no record of a domain that had registry data before. | Always on |
Registrar changed for example.com | Low | The registrar is different from the last lookup. | Registry changes |
Nameservers changed for example.com | Low | The nameservers at the registry are different from the last lookup. | Registry changes |
DNSSEC keys changed for example.com | Low | The DS records at the registry are different from the last lookup. | Registry changes |
The alerts go to the domain's escalation paths. You cannot change the severity of a domain alert.
Open alerts and how they resolve
Each kind of alert is separate. One open alert does not stop another kind from firing, and Spectate resolves each kind on its own:
| Alert | Open at a time | Resolves when |
|---|---|---|
| Expires soon or has expired | One of the two | A lookup shows an expiry date outside the threshold, for example after a renewal. Also when you lower Warn before expiry below the days left. |
| No longer registered | One | A lookup finds the domain at the registry again. |
| Registrar changed | One | A member resolves it on the alert page. |
| Nameservers changed | One | A member resolves it on the alert page. |
| DNSSEC keys changed | One | A member resolves it on the alert page. |
For example, a domain can have an open "Nameservers changed" alert and an open "expires soon" alert at the same time. A renewal resolves the "expires soon" alert. The "Nameservers changed" alert stays open until a member resolves it.
While a change alert is open, a new change of the same kind does not fire a second alert.
Expiry
Spectate compares the expiry date from the registry with the threshold of the domain. The threshold is 30 days by default. You can set 1 to 365 days.
- If the domain expires within the threshold, Spectate fires the "expires soon" alert.
- If the expiry date is in the past, Spectate fires the "has expired" alert.
- When the registry shows a new expiry date after a renewal, Spectate resolves the alert at the next lookup.
The description of the alert gives the days left and the expiry date, for example "Expires in 12 days, on 9 Nov 2026." The title does not change from day to day. While the domain stays in the same state, the alert stays open, and Spectate updates the days left in the description. It does not fire a new alert or escalate again.
If an "expires soon" domain expires, Spectate resolves the "expires soon" alert and fires the "has expired" alert. The new alert goes through the escalation paths again.
Some registries do not publish expiry dates, for example .de, .nl and .eu. Spectate cannot fire expiry alerts for those domains. Renew them at your registrar on time.
Lapsed registrations
If a domain had registry data and the registry then has no record of it, Spectate fires a critical alert. This usually means that the domain expired and the registry deleted it, or that it moved. An open "has expired" alert stays open next to it. When a lookup finds the domain again, Spectate resolves the "no longer registered" alert.
If the registry has no record of a domain that you added recently, Spectate does not fire an alert. The dashboard shows Not registered. Check the spelling, and use the registered domain instead of a subdomain.
Registry changes
A change of registrar, nameservers or DNSSEC keys can be planned work, such as a transfer. It can also be a sign of a hijacked domain. Spectate fires a low severity alert for each change.
Spectate compares the records in a normalised form. A different order of records or fields, upper and lower case, and a trailing dot do not count as a change.
Spectate does not fire a change alert in these cases:
- It is the first lookup of the domain.
- The registry data came from another source than the last time, for example WHOIS instead of RDAP.
- Registry changes is off for the domain.
Change the alert settings
Owners, managers and admins can change the settings.
- Open the domain and go to Settings.
- Under Alerting, find Domain expires soon.
- In Warn before expiry, type the number of days, from 1 to 365.
- Turn Registry changes on or off.
- Select Save changes.
In the public API, the settings are expiry_threshold_days and alert_on_registry_changes.
What domain monitoring does not check
Domain monitoring reads the registry only. It does not query DNS records or your nameservers. To alert on DNS records, such as A, MX or TXT records, add a DNS monitor. To alert on TLS certificates, see certificates.