Domain Monitoring

Track domain registration expiry, registrar, transfer locks, nameservers and DNSSEC — so your domain never lapses, and a hijack attempt reaches you while you can still stop it.

What is a domain monitor?

A domain monitor watches the registry record behind a domain name — not the website served from it. Every day it asks the registry who owns example.com, when the registration expires, which registrar holds it, whether it is locked against transfer, which nameservers it delegates to, and whether DNSSEC is signed.

It is the only monitor type that can warn you about the failure no uptime check can predict: an expired domain. Your server is fine, your certificate is fine, your code is fine — and the whole thing goes dark because a renewal invoice went to an inbox nobody reads any more.

Example: your apex domain renews on 14 March. On 13 January Enori tells you 60 days remain. On 12 February, 30 days. Then 14, 7, 3, 1 — and if it ever hits zero, a critical alert. The renewal has had six chances to reach you before anything breaks.

Domain vs DNS vs SSL — three different expiries

These three get confused constantly, because all three can take a site down and all three involve a date. They watch completely different things.

The short version: the domain is the address, DNS is the directions, SSL is the lock on the door. Losing the address is the worst of the three, and the slowest to fix — an expired domain can enter a redemption period where recovery costs hundreds and takes days.

Do I need a separate domain monitor if I already monitor the website?

Often no. Every Website monitor already tracks domain expiry — it picks up the registration date, registrar and expiry for its hostname automatically, and it fires the same expiry-warning ladder described below.

Create a dedicated Domain monitor when you want the things a Website monitor does not get:

• Transfer-lock, registrar-change and nameserver-change alerts. These are on by default for Domain monitors and off for Website monitors (registrar quirks would make them noisy on a monitor whose job is uptime).
• A domain you don't serve a website from — a brand-defence registration, a parked name, a redirect domain, a domain you own but haven't launched.
• A detail page dedicated to registry state — registrar, lock status, DNSSEC and registry contacts as first-class cards rather than one line on a website page.

When to use one

Good fits:

• Your production apex domain. The single highest-consequence expiry you own.
• Brand-defence and defensive registrations. Names you bought to keep out of someone else's hands, that nobody looks at from one year to the next.
• Domains inherited from an acquisition or an ex-employee's account. The ones where you're not certain the renewal card is still valid.
• Any domain in the middle of a transfer or migration, where lock state and registrar of record actually matter this month.
• Client domains you manage. One monitor per client domain gives you a renewal calendar you didn't have to maintain.

Not a fit:

• Checking whether a site is up. That's a Website monitor — a domain monitor never fetches a page.
• Detecting a changed DNS record (a new A record, a broken MX). That's a DNS monitor, which queries live and can check every minute. A domain monitor only sees nameserver delegation changes, once a day.
• IP addresses. There is no registration record for an IP. Use a Ping or Port monitor instead — the form will reject an IP address here.

How it works

What it reads

Enori queries the domain's registry record over RDAP (the modern, structured replacement for WHOIS) and stores:

How often it checks — two different cadences

This is the part worth understanding, because a domain monitor deliberately behaves unlike every other monitor type.

The registry lookup runs once a day for a Domain monitor. Not every minute — daily. Registries rate-limit hard, a registration date changes at most once a year, and hammering them would get everyone throttled. A domain-tracking Website monitor refreshes weekly instead, tightening to daily once its expiry is within 60 days.

The monitor's own check interval is something else. Between registry lookups, the scheduled check simply re-evaluates the stored expiry date against today — no network call. That's why the check interval for this type has a one-hour minimum: checking more often than that would just write the same answer to your history more times.

You do not have to wait for either cadence to see data. The first registry lookup fires the moment you create the monitor, so registrar and expiry usually appear within a few seconds. And Check Now forces a fresh registry lookup on demand.

What counts as up, expiring, and down

The important one is Expiring Soon. It is a healthy status, deliberately: a domain expiring in three weeks still resolves and still serves traffic. Marking it down would corrupt your uptime figure and your SLOs for a problem that hasn't happened yet. So it stays successful, the pill turns amber (red inside 7 days), and the warning reaches you through alerts instead.

Only an actually expired domain is Down — at which point "the origin is unreachable because the name no longer exists" is exactly right.

Setting one up

Creating a domain monitor takes two steps.

Step 1 — pick the type

On Monitors → Create Monitor, choose Domain from the type picker, then Continue.

Screenshot: the Domain card on the monitor-type picker (step 1).

Step 2 — configure

1. Monitor Name (required)

Whatever you'll recognise in a list at 3 a.m. — "acme.com — apex", "Client: Northwind".

2. Group (optional)

Put related monitors under a shared heading on the monitors list. Pick an existing group or create one inline.

3. Domain Name (required)

The domain itself — example.com. A few rules worth knowing:

• A bare name is what you want. https:// and paths are stripped if you paste a full URL, and a leading www. is removed.
• IP addresses are rejected. Submitting one returns "Domain monitors do not support IP addresses. Use Ping or Port type instead." An IP has no registration record, so there'd be nothing to watch.
• Subdomains resolve upward. Registries publish records for the registrable domain, not for api.example.com. If you enter a subdomain, Enori walks up to the registrable name and reports that registration — which is the right answer, since that's the registration that would actually expire.

4. Check Interval

Set this to 1 hour or longer. Domain monitors enforce a one-hour floor: shorter values are rejected with "Minimum check interval for Domain monitors is 1 hour (3600 seconds)", because scheduled checks only re-read the stored expiry date and the real registry refresh runs daily regardless.

The create form currently opens with 5 minutes pre-selected and offers shorter options — change it before submitting, or the monitor won't be created. 24 hours is the sensible choice for almost every domain; it puts one clean row a day in your history and loses you nothing.

Screenshot: the domain configuration step — Monitor Name, Group, Domain Name, Check Interval.

5. Alert settings

Below the configuration section, the same alert controls as every monitor type: which channels to notify, whether to alert on down and on recovery, the failure threshold, and an escalation policy if you have one. See Alerts for how channels and escalation work.

You can leave all of this at its defaults and tune it later — the expiry-warning ladder is separate and is already on.

Then Create Monitor. The first registry lookup fires immediately; registrar and expiry normally appear within seconds.

Reading the results

The domain detail page is built from cards you can drag into whatever order you prefer.

Domain

The headline: days remaining, in white above 30 days, amber at 30 or fewer, red at 7 or fewer. Under it the registrar, plus up to three small icons — a padlock when the transfer lock is active, a shield when DNSSEC is signed, a warning triangle when expiry is close.

Registrar

The registrar of record, straight from the registry RDAP record. If this ever changes without you initiating a transfer, that's the signal a registrar-change alert exists to raise.

Domain Lock

Three rows — Transfer, Update, Delete — showing which registry locks are set.

The one that matters most is Transfer. With clientTransferProhibited set, your registrar will refuse an outbound transfer request until you deliberately unlock it. It is the single cheapest anti-hijack control available on a domain, and it's free at every registrar. If yours shows unlocked, go and turn it on.

DNSSEC

Enabled (delegation signed — DNS answers can be cryptographically validated) or Disabled (they can't). This reads the registry's record of your DS delegation. It is not the same thing as the DNSSEC validation a DNS monitor can perform on individual lookups — this one answers "is this domain signed at all?".

Registry Contacts

Registrant, admin and technical contact names. Most will read Redacted — since GDPR, the vast majority of registries publish no contact detail at all. That's normal and not a fault; the card is useful mainly for the domains where contacts are published, and for spotting a change.

Configuration

A summary of how this monitor behaves — its schedule, the expiry-warning days currently in force, and whether lock monitoring is on.

The rest

Alerts, recent incidents, maintenance windows, status pages and SSL cards behave exactly as they do on other monitor types.

Any card can read Not tracked when the underlying data hasn't arrived yet or the registry doesn't publish that field. That's a gap in the registry's record, not a fault in the monitor.

Alerts

The expiry warning ladder

By default you get a warning at 60, 30, 14, 7, 3 and 1 days before expiry, plus one on the day of expiry — and a critical alert once the domain has actually expired.

Each rung fires once. Crossing from 31 days to 30 sends one alert; the next comes when you cross into 14. You will not be re-told the same thing every day.

Renew the domain and the ladder resets. When the expiry moves back beyond the widest rung, Enori resolves the open warning with a "Domain renewed until …" all-clear, and re-arms for next year. Renew only partially — say from 7 days to 37 — and you get both: the all-clear for the old date, then a fresh warning at the new one.

Choosing your own thresholds

On the detail page, open Alerts → edit to change the schedule. Four options:

A custom list takes up to 10 values, each between 1 and 365 days, with no duplicates. They're stored newest-first automatically, so you can type them in any order.

Aggressive is worth it for a domain whose renewal has to go through someone else's procurement — 90 days is roughly how long a purchase order takes.

Screenshot: the Alert Settings modal showing the expiry warning schedule presets.

The security alerts

Three more alerts watch for signs your domain is being taken from you. They are on by default for Domain monitors (and off for Website monitors, to keep uptime alerting quiet):

Why these three. A domain hijack has a recognisable shape: unlock the domain, change the nameservers, move it to another registrar. Catching any one of those within a day — while the transfer is still reversible — is the difference between an incident and a catastrophe.

Two deliberate design choices keep them quiet:

• A suspected nameserver change is confirmed before it fires. Enori re-queries immediately and only alerts if both answers agree. A single dropped packet or truncated response won't page you.
• "Unknown" never reads as "changed". If a registry lookup fails or a nameserver query comes back empty, nothing fires and the last known-good value is kept. These alerts require a real before and a real after.

Reordering your nameservers, or a registrar reformatting its own name, will not fire anything — both comparisons ignore ordering, case and formatting.

Where alerts go

Domain alerts use the same channels as every other alert on the monitor — email, Slack, Discord, Teams, webhook, PagerDuty, SMS, and mobile push — plus a row in your notification bell. Set them up once on the monitor and every domain alert follows. See Alerts and Notifications.

Expiry dates also appear on your Timeline, plotted on the date they happen, so a renewal shows up next to your scheduled maintenance rather than only in your inbox.

Maintenance, pausing, and manual checks

Maintenance windows. A domain monitor inside a maintenance window is skipped entirely by the daily registry check — no lookup, no alerts. Useful when you're deliberately mid-transfer and don't want a lock-removal alert you already know about.

Pausing. A paused monitor is skipped too. Nothing is checked and nothing fires until you resume.

Check Now. This does more on a domain monitor than elsewhere: as well as re-evaluating the status, it triggers a fresh registry lookup, so registrar, lock, DNSSEC and expiry all refresh. Use it after renewing a domain rather than waiting for tomorrow's check. Manual checks are capped per day by plan — 20 on Base, 100 on Pro, 500 on Business — with a short cooldown between them.

FAQ

My domain monitor says "Checking" and never changes.

The registry hasn't given us a record. The common causes, in order of likelihood: the domain is very new and not yet published; the TLD is a country-code registry that doesn't operate a public RDAP service; or the name is misspelled. Enori reads roughly 1,200 TLDs through the official IANA registry directory plus a general-purpose fallback — that covers every common gTLD and most ccTLDs, but not all of them. If a domain sits in "Checking" for more than a day, it's most likely a TLD we can't read.

Why isn't my domain monitor checked every minute like my website?

Because there is nothing to see. A registration date changes at most once a year, and registries rate-limit lookups per endpoint — polling them fast would get every Enori customer throttled and tell you nothing new. Once a day catches an expiry, a transfer or a nameserver change well inside the window where you can act on it.

Does "Expiring Soon" hurt my uptime percentage?

No. It's recorded as a successful check. A domain expiring next week still resolves and still serves — treating it as downtime would put a hole in your uptime figure and burn SLO error budget for something that hasn't broken. Only an actually expired domain counts as down.

I renewed the domain. Why does it still say expiring?

The stored expiry date refreshes on the next daily registry check. Hit Check Now to pull the new date immediately — you should see the days-remaining headline jump and an all-clear notice resolve the open warning.

I got a nameserver-change alert and I did change them.

Then it worked as intended. The alert doesn't know whether a change was authorised — only that it happened. The new set becomes the baseline, so you'll only hear about the next change.

Can I turn the lock and nameserver alerts off?

Not from the app today. They're switched on automatically for Domain monitors and off for Website monitors. If a domain of yours is genuinely mid-migration and generating noise, put it in a maintenance window for the duration — the registry check skips it entirely.

The Configuration card says "DNS monitoring — enabled". What does that do?

Nothing yet. That row is a placeholder for a planned feature that would snapshot your DNS records alongside the registry data. It does not change what this monitor checks today. For live DNS record checking, use a DNS monitor.

Why are the registry contacts redacted?

Because the registry redacted them. Since GDPR, most registries publish no registrant, admin or technical contact detail publicly. Enori shows whatever the registry returns and marks the rest Redacted. There's nothing to configure — the data genuinely isn't published.

My registrar shows as "Unknown".

Some registries — particularly thin ccTLD registries — publish an expiry date but no registrar entity. You'll still get every expiry alert; only the registrar row and the registrar-change alert are affected.

Does a domain monitor count against my plan's monitor limit?

Yes, the same as any other monitor. Base includes 10, Pro 50, Business 200.

Can I watch a subdomain's registration?

Subdomains have no separate registration — they're part of the parent domain's. Enter one and Enori reports the registrable domain's registration, which is the one that can actually expire.

Troubleshooting

"Domain monitors do not support IP addresses"

An IP address has no registry record. If you want to check that a host answers, use Ping or Port monitoring; if you want to check that a site serves, use a Website monitor.

"Minimum check interval for Domain monitors is 1 hour (3600 seconds)"

The check interval is set below one hour. Open the interval dropdown and pick 1 hour or longer — 24 hours is the usual choice. This limit exists because scheduled checks read stored data; the registry refresh happens daily no matter what interval you set.

"You already have a monitor for this URL"

You already have a domain monitor for that name. Domain monitors are unique per domain per account — one is enough, since they all read the same registry record.

The monitor sat at "Checking" and then started working days later

The first lookup failed — a registry timeout, a rate limit, or a registry lookup service that was temporarily unavailable — and a later attempt succeeded. Registry lookup failures are retried and never change the monitor's status, so nothing was lost; the data simply arrived late. If you don't want to wait, Check Now forces a retry.

Registrar and DNSSEC show "Not tracked" but expiry works

The registry publishes an expiry date but not those fields. Thin registries commonly return the date and nothing else. Expiry alerts work normally; lock and registrar alerts have nothing to compare and stay quiet.

Nothing fired when my domain crossed 30 days

Check three things: the monitor isn't paused; it isn't inside a maintenance window; and the expiry warning schedule hasn't been set to a preset without a 30-day rung (Minimal is 30/7/1 — Custom lists can be anything). Also confirm at least one alert channel is attached on the Alerts card — with no channel, alerts are recorded in the bell but have nowhere to send.

The domain expired and I got two alerts

That's correct. The expiry ladder sends a critical "Domain has EXPIRED", and separately the monitor's status changed to Down, which fires your normal downtime alert. One tells you the cause, the other tells you the consequence.

Reference: limits and defaults

Related documentation

• DNS monitoring — for the records a domain resolves to, checked live
• Alerts — channels, escalation policies and on-call rotas
• Notifications — the in-app bell and what each event means
• Maintenance windows — suppressing alerts during a planned change
• Timeline — every domain and certificate expiry on one calendar

Last updated: 2026-08-11. Feedback or corrections: support@enori.io