---
title: "Monitor domains and certificates"
description: "Document a client's domains and let Outpost watch registration expiry, SPF, DKIM, and DMARC records, and the certificate each domain presents."
url: "https://support.outpostplatform.com/documentation/domains-and-certificates/"
product: "depot"
type: "how-to"
status: "draft"
ai_summary: "How to add a domain under Documentation > Domains and certificates in the Outpost console and choose what Outpost watches: registration expiry through RDAP, DNS and mail records (SPF, DKIM, DMARC), and the certificate on port 443. Checks run every 24 hours by default. Endpoint inventory certificates are mirrored too. Not available offline on Remote Outpost. Needs docs:write."
availability:
  plans: ["home-lab", "essentials", "enterprise", "msp"]
  permission: "docs:write"
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/documentation/domains-and-certificates.md"
license: "CC BY 4.0"
---

# Monitor domains and certificates

A domain that lapses or a certificate that expires takes a client offline in a
way nobody notices until customers do. Under **Domains and certificates**, you
record each domain a client owns, and Outpost checks its registration, its mail
authentication records, and the certificate it presents, then warns you before
anything runs out. This page shows how to add a domain and what Outpost checks.

## Before you begin

- You need `docs:write` to add and change domains. `docs:read` is enough to
  view them.
- Domain checks reach the public internet. A Remote Outpost cannot run them.
  You can still document domains there and type their expiry dates in.

## Add a domain

1. In the client's **Documentation**, go to **Domains and certificates** and
   select **New domain**.
2. Under **Registration**, in **Domain**, enter the domain name, such as
   `example.com`.
3. Optionally, enter the **Registrar**.
4. In **Registration expires**, type the date if you know it. Outpost fills it
   in from the registry when it can reach one.
5. Under **What Outpost watches**, choose the checks:
   - **Watch the registration expiry**
   - **Watch the DNS and mail records**
   - **Watch the certificate**
6. Optionally, list the **Nameservers**, one per line.
7. To check DKIM, enter the **DKIM selectors** your mail provider uses,
   separated by commas. Without a selector there is nothing to look up.
8. Select **Save**.

To run the checks straight away rather than waiting for the next pass, open the
domain and select **Check it now**.

## What Outpost checks

Each check is recorded separately, so a registry that does not answer is not
reported as a DNS failure.

| Check | How | What you see |
| --- | --- | --- |
| Registration | RDAP over HTTPS, through the public rdap.org redirector, to the domain's registry | **Registration expires** is filled in. When the registry has no RDAP answer, the check records an error and keeps the date you typed. Outpost never guesses a date. |
| DNS and mail | DNS lookups through the server's own resolver | The **Mail authentication** card shows **SPF**, **DKIM**, and **DMARC** as **Published**, **Not published**, **Published but invalid**, or **Not checked**. |
| Certificate | A TLS connection to the domain on port 443 | A certificate card shows **Issued by**, **Valid until**, **Also covers**, **Fingerprint**, and **Where it came from**. The certificate is read even when it is self-signed or untrusted, because the question is when it expires. |

**Last check** on the domain shows the result of the latest pass: **Checked**,
**Check failed**, or **Could not check**. **Could not check** means the check
could not run at all, such as on a Remote Outpost. It does not mean the domain
is fine.

Outpost checks each domain every 24 hours by default. An administrator can
change the interval to between 1 and 168 hours, or turn domain monitoring off,
in **Documentation** > **Settings** with **Check a domain every, hours** and
**Watch domains and their certificates**. With monitoring off, a domain still
shows what it last knew.

## Certificates from endpoints

Certificates also come from endpoints. When an endpoint's inventory reports a
certificate, Outpost records it with **Where it came from** set to **Reported
by the endpoint** and links it to that endpoint. Certificates found by the
domain check show **Found by the monitor**.

## Reminders

Registration and certificate expiry dates appear on
[Expirations](/documentation/expirations/) and raise `documentation` alerts at
the first reminder (30 days by default) and again at the second (7 days by
default).

## Verify

Open **Domains and certificates**. The domain is listed with its **Registrar**,
its **Registration** date, and a **Last check** time. A domain with every check
turned off shows **Not being watched**. Open the domain and confirm the
**Mail authentication** card and the certificate card are filled in.

## If something goes wrong

| Symptom | Cause | Fix |
| --- | --- | --- |
| **Last check** shows **Check failed** for the registration. | The registry did not answer over RDAP, which some country-code registries do not support. | Type the date into **Registration expires**. Outpost keeps it. |
| DKIM shows **Not checked**. | No DKIM selector is recorded. | Enter the selector in **DKIM selectors** and select **Check it now**. |
| Every domain shows **Could not check**. | This is a Remote Outpost, which has no route to the internet. | Type the dates in. They still come due and still raise reminders. |

## Next steps

- [Track expirations](/documentation/expirations/)
- [Vendors, licenses, and processes](/documentation/vendors-licenses-processes/)