Domains and certificates
The full DNS, the served certificate, the domain's registry record and email, surveyed every six hours for the production domain and its subdomains — with the history of what changed and three alerts.
Pro plan and aboveUpdated on 17 September 2026
On this page
The Health page says in four verdicts whether the domain is fine. Domains and certificates (Project → Monitoring → Domains and certificates) does the detail: everything under the site, re-read regularly, compared from one survey to the next, and kept over time. This is where you see a CNAME change on a Tuesday without a deployment, a certificate signed by an issuer you never chose, or a domain expiring in three weeks.
What PostShip does
The survey
Every six hours — and right after a deployment — PostShip surveys each tracked domain of the project:
| Piece | What is read | From |
|---|---|---|
| DNS | A, AAAA, CNAME, MX, NS, TXT, CAA, the shortest TTL, DNSSEC validation | a DNS-over-HTTPS resolver |
| Certificate | the issuer, the covered names, the chain up to the root, the negotiated protocol, the days left, and whether TLS 1.0/1.1 are still accepted | a TLS handshake with the server |
| Domain | the registrar, the registration and expiry dates, the statuses (transfer locked, held…), the name servers, DNSSEC | the registry's RDAP record |
| SPF, DKIM, DMARC — the same checks as Email (DNS) | DNS | |
| Issued certificates | the certificates signed for the domain in the last seven days and their issuers — see Certificates | transparency logs |
Email and issued certificates are read at the registrable domain (shop.example), not at each subdomain. A read that fails — silent resolver, registry down — does not replace the last good one: the card keeps what it knew and says what could not be read.
The production domain and subdomains
The domain of the production URL is tracked by default, from the first visit to the page. You add the other hosts by hand — www, api, app, status — as long as they sit under the same domain: each has its own certificate and its own DNS, and it is often the forgotten API whose certificate expires. Up to 3 domains per project with the Pro plan, 10 with Team, 25 with Agency. If the production URL changes, the old domain stays tracked as a subdomain and the new one takes its place.
What changed
Each survey is compared with the previous one, piece by piece, and every difference is written down: “CNAME: a.vercel.app → b.netlify.app”, “Issuer: Let's Encrypt → Google Trust Services”, “Expiry: 2027-03-01 → 2028-03-01”. The order of values never matters. The list, at the bottom of the page, gives the domain, the date, the piece, the before and the after — and marks what alerted.
Settings
Nothing to set for the survey itself. “Survey now”, at the top of the page, forces a pass (at most one every ten minutes). The three alerts can be switched off one by one in Automation → Alert rules: DNS changed, Domain expiring soon, Unexpected certificate — all on by default.
What triggers an alert
Every change is recorded; only these alert, with the diff in the message:
- DNS changed: a CNAME, name servers, an MX or a CAA that changes; A or AAAA addresses all replaced or gone; an SPF or DMARC rewritten. Part of the addresses rotating — a CDN — does not alert, nor does a changing verification TXT.
- Domain expiring soon: at 30, 7 and 1 day from the registry expiry date, then the day it expired. One alert per threshold, never two.
- Unexpected certificate: the site serves a certificate from a different issuer than last time, or a never-seen issuer just signed one for your domain in transparency logs.
Alerts go to your channels and by email to the project owner; an account that muted everything (holidays) gets none. A certificate renewal, a TTL, one more covered name, a changing registrar: history, not an alert.
Limits and plans
| Free | Pro | Team | Agency | |
|---|---|---|---|---|
| The page | preview | Yes | Yes | Yes |
| Tracked domains per project | — | 3 | 10 | 25 |
| Six-hour survey, history, alerts | — | Yes | Yes | Yes |
The Health page stays open to everyone. See plans.
Troubleshooting
“No record at the registry”
Some extensions publish no RDAP, and a few registries refuse automated reads. The expiry date is then checked with your registrar; DNS and the certificate are surveyed normally.
“Only subdomains of … can be tracked here”
A project tracks one domain and what sits under it. Another domain — another client's site, a redirect domain — is another project.
The DNS changed and I did nothing
That is exactly the case the page catches. Check with your registrar (access, last login, transfer in progress) and your host (a deleted project, a reassigned domain). If the change is yours, the entry stays in the history and says when.
Why is “TLS 1.0/1.1 still accepted” orange?
These versions have been broken for years and are refused by recent browsers; a server that still accepts them does so by configuration oversight. It is not an outage, it is something to fix with the host or in the server configuration.