Check types
Twelve check types, available on every plan. This page says what each one verifies and which details come back with a result, so you know before you sign up.
The list
| type | what it verifies |
|---|---|
| http | Availability and response of a URL, with assertions |
| http_headers | Security-header posture of a URL |
| tcp | A port accepts connections |
| dns | A name resolves to the records you expect |
| dns_hygiene | SPF, DMARC, and CAA are configured sanely |
| domain | NS, SOA, DNSSEC, and WHOIS expiry of a domain |
| ssl_cert | Certificate validity, expiry, issuer |
| smtp | Your mail server accepts delivery |
| imap | Your mailbox endpoint answers |
| ping | A host answers ICMP |
| traceroute | The network path to a host |
| agent | A host’s own vitals, from the inside |
Intervals go down to 10 seconds depending on plan; the floors per plan are on the pricing page. Every check runs from probe regions on six continents and an incident opens only after quorum, the rule the SRE page explains.
Web
http requests a URL and asserts on the result: expected status code, a keyword the body must contain, or a regular expression against the body. Redirects are followed up to 5 hops, and every hop is validated against SSRF targets before it is fetched. An http monitor also carries TLS-certificate, security-header, and DNS-hygiene subchecks inline, so one monitor covers what used to take four.
http_headers checks the security headers you keep meaning to set, as their own monitor with its own record.
DNS and domain
dns resolves a name and compares the answer set against what you expect. A DNS monitor can also cross-reference its answers against another monitor’s answer set, and a divergence runs through the normal incident pipeline.
dns_hygiene checks SPF, DMARC, and CAA as configuration, not vibes: the records that decide whether your mail gets delivered and who may issue certificates for you.
domain watches the registration layer: NS and SOA consistency, DNSSEC, and WHOIS expiry, so a lapsing domain is a warning weeks ahead, not a Saturday surprise.
ssl_cert watches a certificate directly: validity, chain, expiry, issuer, and self-signed detection, independent of any http monitor.
smtp and imap check the mail path your password resets and invoices depend on: the server accepts connections and speaks its protocol, from six continents.
Network
ping answers the basic question, is the host reachable at all. traceroute records the path, which is the evidence you want when the fault is a network in between, not your service.
Host
agent binds a monitor to the host agent (Linux x86_64 and aarch64, macOS universal): availability with a grace period, CPU, memory, and disk against thresholds, and named services with anti-flapping grace. Missing data counts as pending, not as a false alarm; a silent agent counts as down.
What every result carries
- Dual-stack, per IP. Checks run across all A and AAAA records with per-family and per-IP results; whether an IPv6-only failure counts as degraded or failed is your call.
- DNS time separated.
dns_msis reported apart from total latency, so a slow resolver does not masquerade as a slow app. - Cause attribution. Failures are attributed to a layer: your app, your DNS, the network, our resolver, or our own probe node. When the fault is on our side, the record says so.
Start monitoring free, or see the product tour, no signup.