How to Monitor a Domain Name
Domains fail silently. Nothing tells you when a nameserver changes, when a certificate is about to expire, or when the name you have been waiting three months for finally drops. Here is what to watch and how.
September 9, 20266 min readMonitoring · DNS · Domain Hub
The Domain Hub checks every domain you add each day and tells you what changed and when it expires.
Open the Domain HubThe short answer. Six things are worth watching: expiry dates, nameservers, registrar, registry status codes, DNS records and TLS certificates. None of them notify you when they change, and every one of them can take a business offline.
Domains are unusual infrastructure. They work perfectly for years, require no attention, and then fail completely with no warning at all. There is no dashboard that goes red. The first signal is almost always a customer telling you your site is down, or your email quietly not arriving.
This is what to watch, why each one matters, and how to actually do it.
The two reasons to monitor
They are completely different jobs, and conflating them is why people end up with the wrong setup.
Defensive. You own names and cannot afford to lose them or have them tampered with. You are watching for expiry, hijacking and misconfiguration.
Acquisitive. You want a name someone else holds. You are watching for the moment it becomes reachable, which is a lifecycle question rather than an availability one.
Most tools do one or the other. You usually need both.
What to actually watch
| Signal | Why it matters | How fast you need to know |
|---|---|---|
| Expiry date | The single most common way domains are lost | Weeks of warning |
| Nameservers | A change you did not make means hijacking | Immediately |
| Registrar | An unexpected transfer means you are losing it | Immediately |
| Registry status codes | Locks, disputes, expiry stages | Same day |
| DNS records | MX or A changes break mail and web | Immediately |
| TLS certificate expiry | Browsers block the site outright | Days of warning |
Expiry is the boring one that actually gets people
Renewal notices go to the registrant email in the registration record. That address is frequently a personal account of someone who left the company, a mailbox nobody reads, or an address at the very domain that is about to expire. When that happens, the warning system and the thing being warned about fail together.
Auto-renew helps and does not solve it, because auto-renew depends on a stored payment method that expires on its own schedule. A card replaced eighteen months ago is the most common single cause of a lost domain.
Watch expiry independently of the registrar. A monitor that reads the public registration record does not care whether your renewal notice reached anyone.
Nameservers are the security signal
If someone changes your nameservers, they control where your website and email go without ever touching your registration. The domain still shows your name in the record. Nothing looks wrong from the registrar's side.
This is the difference between domain hijacking and DNS hijacking, and the second is much harder to spot. We cover how both work and why the DNS variety is the one that goes unnoticed.
An unexpected nameserver change is the highest-severity event on this list. There is no benign explanation you did not already know about.
Watching a name you want
Availability monitoring is a different problem, because a name you want is usually not simply taken or free. It is somewhere in a lifecycle.
A domain that has expired is not available. It moves through a grace period, then 30 days of redemption, then five days of pending delete, and only then does it release. The full timeline is here, and the important part is that the registry status codes tell you exactly which stage a name is in.
| Status | What it means for you |
|---|---|
ok | Registered and healthy, no signal |
clientTransferProhibited | Normal lock, means nothing about availability |
redemptionPeriod | Expired, 30 to 35 days out, owner may still restore |
pendingDelete | Five days out, exactly, nobody can stop it |
Watch status codes, not expiry dates. An expiry date tells you when a process might start. Status codes tell you where the domain actually is. The gap between those two is often two months.
How to monitor, from cheapest to best
Manually
Check the registration record yourself, periodically. Free, and it works for one or two names you care about deeply.
The failure is obvious: you check when you remember, and the events worth catching happen when you are not looking. A nameserver change discovered nine days later is not a detection, it is an autopsy.
Calendar reminders
Put expiry dates in a calendar a month ahead. Genuinely better than nothing, and it covers the single most common failure.
It covers nothing else. No calendar tells you your nameservers changed this morning.
Registrar notifications
Your registrar will email about renewals. This is useful and it is also the system with the flaw described above: it depends on an email address in a record that may be stale, and it tells you nothing about DNS or certificates.
Dedicated monitoring
A service that reads the public record on a schedule and tells you when something changes. This is the only approach that covers the whole list, and the only one that works on names you do not own.
The thing worth insisting on is that it records what a value changed from, not just that it changed. "Nameservers updated" is an alert. "Nameservers changed from ns1.yourhost.com to ns1.sedoparking.com" is an answer. The first makes you go and investigate. The second tells you immediately whether it was you.
That is how Domain Hub is built: it records the previous value beside the new one on every change, tracks lifecycle stage rather than just expiry dates, and sends urgent changes as they are found rather than batching everything into a weekly summary.
A sensible setup
For names you own:
- Expiry watched independently of the registrar
- Nameserver and registrar changes alerting immediately
MXrecords watched, because broken mail is silent- Certificate expiry with at least a week of warning
- Registrar lock on, and two-factor authentication enabled
For names you want:
- Status codes watched rather than availability
- Alerts on stage transitions, especially entry into
pendingDelete - A backorder placed before the drop, not after
For a portfolio of any size:
- One digest rather than one message per domain, or you will start ignoring them
- Urgent changes exempt from the digest and sent immediately
- Renewal costs totalled, so the annual bill is not a surprise
Alert fatigue is the real failure mode. A monitor that emails you about every routine change trains you to ignore it, and then it fails at the one moment it mattered. Urgent and routine need different channels.
What monitoring cannot do
Being honest about the limits:
It reads the public record, not your registrar account. It sees what the registry publishes. It cannot see your login history or your billing.
Drop dates are projections until pending delete. The grace period length is set by each registrar and published nowhere, so any estimate before that stage carries real uncertainty.
It cannot renew for you. Detection is not prevention. Auto-renew and a valid payment method are still your first line, and monitoring is the backstop for when they fail.
Nobody can tell you whether a domain will renew. Most expired domains are recovered by their owners. A countdown is not a promise.
Start with the one that matters
If you do nothing else, watch expiry on the names your business actually runs on, using something that does not depend on the registrar's email reaching you.
That single check prevents the most common and most expensive domain failure there is. Everything else is worth adding once that one is covered.
Put the research to work.
Check your shortlist across the extensions that matter, then save the strongest names to a project.
Check a domain