# Check SSL certificates, domains and DNS

> Every uptime monitor also checks its SSL certificate, domain expiry (RDAP) and NS/MX records, and alerts before expiry or when DNS changes.

Every [uptime monitor](/docs/uptime/) also checks the SSL certificate, domain registration and DNS records of its URL. The team gets an alert before a certificate or domain expires, when a certificate becomes invalid and when DNS records change.

## Requirements

- An uptime monitor. The three checks are on by default.
- For the certificate check, an `https://` URL.

## Turn checks on or off

1. Open the monitor's page from **Uptime**.
2. Under **Certificate, domain & DNS**, tick or untick **SSL certificate**, **Domain expiry** and **DNS changes**.
3. Optional: tick **Also A, AAAA and CNAME records**.
4. Click **Save**.

In the API: the `check_ssl`, `check_domain`, `check_dns` and `dns_addresses` fields of `updateMonitor`.

## Check that it works

The **Health** row on the monitor's page has the tiles **SSL**, **Domain** and **DNS**, each **Pending** until its first check, within a minute. The cards below show the certificate, the domain's expiry date, and the DNS records with **Recent changes**.

The monitor list shows a badge when a certificate is invalid (**SSL invalid**) or expires within 14 days (**SSL 9d**), or a domain expires within 30 days (**Domain 21d**).

## SSL certificate

| | |
|---|---|
| How often | Every 6 to 12 hours, and within a minute after a new monitor or a new host. |
| What it reads | Expiry date, issuer, names, and whether the certificate is valid for the host (Mozilla's root certificates). |
| Expiry alerts | 14, 7, 3 and 1 days before it expires, each once per certificate. |
| Invalid alert | When it expires, names the wrong host or has an unknown issuer. Once, until it is valid again. |

A failed connection gives no certificate alert; the uptime check reports it. When a check fails because of the certificate, the monitor's down alert says why and no separate certificate alert is sent.

## Domain expiry

Lampwick looks up the registrable domain of the URL once a day through RDAP, at the registry's server from the IANA bootstrap file. For `shop.example.com` that is `example.com`, for `x.github.io` it is `github.io`. Monitors on one domain share one lookup.

| | |
|---|---|
| Expiry alerts | 30, 14, 7 and 1 days before the registration expires, once per threshold, expiry date and project. |
| Registry without an expiry date | Some registries, including `.nl`, publish no expiry date or have no RDAP server. The tile says **Unknown**, no alerts are sent, and Lampwick tries again weekly. |
| Failed lookups | Retried after 1, 2, 4 … hours, at most a day apart. |

A URL with an IP address or an unknown suffix has no registrable domain; the tile says **None**.

## DNS changes

| | |
|---|---|
| How often | Hourly. |
| Records | NS and MX of the host and its domain. With **Also A, AAAA and CNAME records**, those too. |
| Resolvers | Public resolvers (Cloudflare and Google), never your server's own. |
| Confirmation | A difference is looked up again after 5 minutes. Only when the second lookup agrees does the change go into **Recent changes** and alert. |
| Alert | **DNS records changed: HOST**, listing the added and removed records. |

A, AAAA and CNAME are off by default because CDNs and load balancers rotate them.

## Paused and muted monitors

A paused monitor gets no host checks. With **Mute alerts for everyone**, the checks run but no one gets [alerts](/docs/alerts/).

## Troubleshooting

| What you see | Cause and fix |
|---|---|
| **SSL: None**, "Only https URLs have a certificate" | The monitor's URL is `http://`. Change it to `https://` to check the certificate. |
| **SSL: Unknown**, "Could not read it: …" | The handshake failed. The uptime check shows whether the site is reachable. |
| **Domain: Unknown**, "the .nl registry doesn't publish expiry dates" | Lampwick can't warn you before expiry. Turn on auto-renew at your registrar. |
| **Domain: Unknown**, "the lookup failed; Lampwick retries it" | The RDAP server didn't answer or returned an error. Lampwick retries, at most a day apart. |
| **DNS: None** | The URL is an IP address, or a name that public DNS can't resolve, such as `localhost` or `*.internal`. |
| Frequent **DNS records changed** alerts | Your CDN or load balancer rotates the A, AAAA or CNAME records. Untick **Also A, AAAA and CNAME records**. |

To find broken links on the same site, [turn on the site crawl](/docs/crawler/).