Monitor domains and certificates

A domain that lapses or a certificate that expires takes a client offline in a way nobody notices until customers do. Under Domains and certificates, you record each domain a client owns, and Outpost checks its registration, its mail authentication records, and the certificate it presents, then warns you before anything runs out. This page shows how to add a domain and what Outpost checks.

Before you begin

• You need docs:write to add and change domains. docs:read is enough to view them.
• Domain checks reach the public internet. A Remote Outpost cannot run them. You can still document domains there and type their expiry dates in.

Add a domain

1. In the client’s Documentation, go to Domains and certificates and select New domain.
2. Under Registration, in Domain, enter the domain name, such as example.com.
3. Optionally, enter the Registrar.
4. In Registration expires, type the date if you know it. Outpost fills it in from the registry when it can reach one.
5. Under What Outpost watches, choose the checks:
   • Watch the registration expiry
   • Watch the DNS and mail records
   • Watch the certificate
6. Optionally, list the Nameservers, one per line.
7. To check DKIM, enter the DKIM selectors your mail provider uses, separated by commas. Without a selector there is nothing to look up.
8. Select Save.

To run the checks straight away rather than waiting for the next pass, open the domain and select Check it now.

What Outpost checks

Each check is recorded separately, so a registry that does not answer is not reported as a DNS failure.

Check	How	What you see
Registration	RDAP over HTTPS, through the public rdap.org redirector, to the domain’s registry	Registration expires is filled in. When the registry has no RDAP answer, the check records an error and keeps the date you typed. Outpost never guesses a date.
DNS and mail	DNS lookups through the server’s own resolver	The Mail authentication card shows SPF, DKIM, and DMARC as Published, Not published, Published but invalid, or Not checked.
Certificate	A TLS connection to the domain on port 443	A certificate card shows Issued by, Valid until, Also covers, Fingerprint, and Where it came from. The certificate is read even when it is self-signed or untrusted, because the question is when it expires.

Last check on the domain shows the result of the latest pass: Checked, Check failed, or Could not check. Could not check means the check could not run at all, such as on a Remote Outpost. It does not mean the domain is fine.

Outpost checks each domain every 24 hours by default. An administrator can change the interval to between 1 and 168 hours, or turn domain monitoring off, in Documentation > Settings with Check a domain every, hours and Watch domains and their certificates. With monitoring off, a domain still shows what it last knew.

Certificates from endpoints

Certificates also come from endpoints. When an endpoint’s inventory reports a certificate, Outpost records it with Where it came from set to Reported by the endpoint and links it to that endpoint. Certificates found by the domain check show Found by the monitor.

Reminders

Registration and certificate expiry dates appear on Expirations and raise documentation alerts at the first reminder (30 days by default) and again at the second (7 days by default).

Verify

Open Domains and certificates. The domain is listed with its Registrar, its Registration date, and a Last check time. A domain with every check turned off shows Not being watched. Open the domain and confirm the Mail authentication card and the certificate card are filled in.

If something goes wrong

Symptom	Cause	Fix
Last check shows Check failed for the registration.	The registry did not answer over RDAP, which some country-code registries do not support.	Type the date into Registration expires. Outpost keeps it.
DKIM shows Not checked.	No DKIM selector is recorded.	Enter the selector in DKIM selectors and select Check it now.
Every domain shows Could not check.	This is a Remote Outpost, which has no route to the internet.	Type the dates in. They still come due and still raise reminders.

Next steps

• Track expirations
• Vendors, licenses, and processes