SSL/TLS · DNS · Domain Expiry
SSL, DNS & domain monitoring for production teams
Continuously verify SSL/TLS certificates, DNS records, and domain expiry across your fleet. Programmable through a REST API. Delivered through nine alert channels.
What we monitor
Certificate expiry, issuer, subject alternative names, chain validation, and signature algorithm. Private/certificate-origin monitoring available on Pro and up.
Per-site thresholds: 60, 30, 14, 7, 1 days, or any custom lead time.
A, AAAA, CNAME, MX, TXT, and NS record tracking. Detects record changes and DNS hijacking attempts.
Diff-based change detection with full historical record state.
Registration expiry, registrar, registrant changes, and WHOIS-based monitoring.
Multi-stage expiry warnings at 90, 30, 14, 7, and 1 days before lapse.
Monitors public Certificate Transparency logs for newly issued certificates on your domain - catching unauthorized issuance, phishing certs, and auto-renewal failures.
Instant alert when a new certificate is issued for your domain by an unrecognized CA.
Developer API
Programmable monitoring
REST API with Bearer-token authentication. Add sites, trigger on-demand checks, query status, and manage alert channels from your scripts and CI pipelines.
MCP & programmatic access
Query your fleet from any MCP client.
Expose SSL, DNS, and domain status to Claude and other MCP clients. The public endpoint checks any domain without signup; the private endpoint reads your own monitored sites.
Failure modes we detect
Certificate expiry destroys trust signals
Browsers surface "Not Secure" warnings. Visitors abandon sessions. Search engines demote ranking. Recovery requires both renewal and reputation work.
DNS hijacks enable downstream compromise
Undetected record changes route legitimate traffic to attacker-controlled infrastructure. Credentials and session tokens are exposed on your domain.
Public tool
Inspect any domain's certificate chain
No signup required. View issuer, expiry, signature algorithm, and full SAN list before creating an account.
Alert channels
Free: in-dashboard alerts. Starter and Pro: Email, Slack, Discord, Microsoft Teams, Telegram, DingTalk, Feishu, PagerDuty, and generic webhooks.
Pricing
Pricing for every operational scale
Every plan includes SSL/TLS, DNS, and domain monitoring. REST API available on all plans. Cancel any time.
Free
For individual projects and evaluation
$0/mo
- Two monitored sites
- Daily SSL & DNS checks, weekly domain checks
- In-dashboard alerts
- REST API access
- External alert channels
Starter
For small teams and production side-projects
$7.9/mo
$9.9$79/yr (17% off)
- Five monitored sites
- Daily SSL & DNS checks, weekly domain checks
- All nine alert channels
- Email, Slack, Discord, Teams, Telegram, DingTalk, Feishu, PagerDuty, Webhook
- Two thousand API calls/month at five QPS
Pro
For production workloads and small SRE teams
$15.9/mo
$19$159/yr (17% off)
- Twenty monitored sites
- Daily SSL & DNS checks, weekly domain checks
- All nine alert channels
- Email, Slack, Discord, Teams, Telegram, DingTalk, Feishu, PagerDuty, Webhook
- Ten thousand API calls/month at ten QPS
Annual billing available (seventeen percent off). REST API on every plan.
FAQ
Three things: SSL/TLS certificates (expiry, issuer, chain, SAN, signature algorithm), DNS records (A, AAAA, CNAME, MX, TXT, NS), and domain registration (expiry, registrar, WHOIS changes). All three are included on every plan.
Yes. The Private Certs agent runs on your infrastructure and inspects the certificate the origin actually returns. Useful for Cloudflare and other CDNs that hide the real cert from the public handshake.
Email, Slack, Discord, Microsoft Teams, Telegram, DingTalk, Feishu, PagerDuty, and generic webhooks. Default lead times are 60, 30, 14, 7, and 1 days before expiry, and the set is editable per site.
Two sites, daily SSL & DNS checks plus weekly domain checks, all three monitoring categories, REST API, dashboard alerts. No credit card. No expiry.
Yes. REST API with Bearer-token auth (sp_ prefix), OpenAPI 3.1 spec at /openapi.yaml, official MCP server for AI assistants. Every plan includes API access, rate limits scale with tier.
For public certificates, DNS, and domains: no. Type a domain, the check starts in under a minute. For private or origin certificates, deploy the Private Certs agent on a host that can reach the service (requires Pro plan or above).
In the United States. Our primary infrastructure is Supabase (database, hosted in the US) with the application served through Cloudflare's global edge network. Data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Backups kept for 7 days.
The check result is recorded with the exact error, the dashboard surfaces it under the site, and any alert thresholds you have configured fire on the channels you have enabled. You can re-run a single site from the dashboard or the API without waiting for the next interval.
Start monitoring in thirty seconds
No credit card required. Two sites free for the lifetime of the account.