Domain check · Perstat

On this page

What it verifies
Configuration
How a check runs
What a result contains
States and severity
Plans and limits
From the pipeline or an agent
Limits
Related check types

What it verifies

A domain monitor reads the apex NS set of a registrable domain from each of its regions at every interval. It asks every authoritative nameserver directly for the zone’s SOA and compares the serials, which exposes replication drift, an unreachable nameserver, or one that does not serve the zone. It then reads the registration expiry over WHOIS and validates DNSSEC, covering the DS record at the parent, the DNSKEY, and the RRSIG that expires first.

Use it when

A domain carries production traffic or mail, and its delegation must stay consistent across all nameservers, including a secondary that someone else operates.
A registration must not lapse unnoticed. The expiry date should become a finding 14 days ahead by default, or at the threshold you set.
The domain is DNSSEC-signed, and an expired RRSIG or a BOGUS validation should open an incident, not wait for the first complaint.

For individual records and answer sets, use the DNS record check. For SPF, DMARC, and CAA, use the DNS hygiene check. A single label is not a registrable domain and is rejected when the monitor is saved.

The monitor form with type Domain: the domain field, the text area for expected nameservers, one per line, and the warning threshold for the registration expiry in days. — The Domain form: domain, expected NS, and the warning threshold for the registration expiry. Real product UI, sample data.

Configuration

Domain. A registrable domain with at least 2 labels, such as example.com, without scheme, path, or spaces. The check reads the apex NS set of exactly this name.

Field	Required	Values and default	Meaning
`domain`Domain	yes	Registrable domain, at least 2 labels	The domain whose delegation, registration, and DNSSEC state are checked.
`expected_ns`Expected NS (optional)	optional	List of nameserver names. Form: one per line or comma-separated	Every listed name must appear in the apex NS set, with case and a trailing dot ignored. A missing name turns the check degraded, and unlisted nameservers in the zone are not a finding.
`warn_days`Warn at remaining lifetime (days)	optional	Days, default 14	The check turns degraded when the registration expires within this many days. Unlike the certificate warning window, this threshold changes the monitor state.
`interval_seconds`Check interval	optional	Default 300 s. Range: plan minimum to 24 h	How often each region runs the check. A value outside the range is raised to the plan minimum or capped at 24 h, not rejected.
`regions`Regions	optional	Subset of na, eu, as, sa, af, oce. Default: the plan’s regions	Which continents run the check. Omit it and the plan picks its default set.

How a check runs

Each region due for the interval reads the apex NS set through the node’s own resolver. A failed lookup or an empty set fails the check right there.
Every nameserver is resolved to its addresses, IPv4 first and IPv6 as a fallback. It is asked directly for the zone’s SOA, and the 10 s check budget allows up to 5 s per nameserver. The first address that answers counts, and each nameserver gets its own sub-result with serial and address.
The zone component is judged next. No SOA from any nameserver fails the check. A missing expected nameserver, diverging serials, or only part of the nameservers answering is degraded.
The registration expiry is read over WHOIS: IANA names the WHOIS server of the TLD, that server is asked over TCP port 43, and the expiry date is parsed. The answer is cached in the probe process for 24 h, so each probe node asks the registry once a day, not at every interval. Each of the 2 WHOIS queries, to IANA and to the TLD server, has a timeout of 8 s.
DNSSEC is validated through the node’s validating resolver, covering the DS record at the parent, the DNSKEY, and the RRSIG that expires first. An RRSIG with 3 days or less remaining is degraded, and an expired signature or a BOGUS validation fails the check. An unsigned domain passes this component.
The worst component sets the result, and the detail line carries all 3 components. The node ends a run that exceeds 120 s with an error. The region’s result goes to the control plane, where the alert policy decides whether a failure opens an incident once the quorum agrees.

The monitor view of a domain check for perstat.io with uptime and the zone verdict. It also shows one line per nameserver with its SOA serial and address, the registration expiry, and the DNSSEC state. — The monitor view: nameservers with SOA serials, registration expiry, and DNSSEC for perstat.io. Real product UI, sample data.

What a result contains

Zone and delegation: The line states how many nameservers answered, whether their SOA serials agree, and which serial the zone carries. If an expected nameserver is missing from the NS set, the line names it instead.
Per nameserver: One sub-result per authoritative nameserver: SOA serial 2026091301 @ 203.0.113.53, NS IP not resolvable, or no SOA with the last error the server returned.
Registration expiry: Days until the registration expires. Inside the warning window the line reads registration expires in 12d. Without a usable registry answer it reads expiry unknown (WHOIS could not determine it).
DNSSEC: The line reads DNSSEC valid (RRSIG 12d) or not DNSSEC signed, or it names a signature that expires within 3 days. It reports BOGUS when a DS record exists but validation fails. The result DNSSEC not checkable (DNSKEY not resolvable) also passes.
Lookup time: latency_ms carries the duration of the NS lookup and the SOA queries. The WHOIS lookup and the DNSSEC validation are not part of it.
Nameservers: values carries the apex NS set as it was read, in lowercase and without the trailing dot.
Cause layer: A failing or degraded component is attributed to the target’s DNS (target_dns). A failed NS lookup is classified by its error: NXDOMAIN or NODATA as target_dns, anything else as unknown.
Region: Every result carries the region that measured it. There are no sub-results per IP family or per address for this type.

States and severity

okEvery nameserver answers with the same SOA serial, and every expected nameserver is present. The registration expires later than warn_days from now, and DNSSEC validates or the domain is unsigned. A WHOIS lookup without a usable answer keeps this state and reports expiry unknown.
degradedAn expected nameserver is missing from the NS set, the SOA serials diverge, or only part of the nameservers answer. The check is also degraded when the registration expires within warn_days or an RRSIG expires within 3 days.
downThe NS lookup fails or returns no records, or no nameserver delivers a SOA. The check also fails when the registration has expired, DNSSEC is BOGUS, or an RRSIG has expired.
errorThe domain is empty or the node’s resolver cannot be initialized. It counts as an outage with severity critical.

Confirmed by quorum: by default, 2 regions must report the failure before an incident opens. The organization default asks for 2 regions and 2 consecutive checks. A monitor can carry its own rule (count or percent, consecutive checks, and minimum duration).

Plans and limits

Shortest interval: Free allows 300 s, Pulse 60 s, and Sentinel 30 s. Command allows 15 s and Enterprise 10 s, both only through MCP. The web form offers 30 s, 1 min, 5 min, 15 min, and 1 h.
Regions: Free runs 2 of 6 regions and Pulse 3 of 6. All 6 are available from Sentinel.
Monitors: Free includes 10 probe monitors, Pulse 50, Sentinel 150, and Command 500. Enterprise quotas are custom. The count covers the 11 regional check types.

Compare every plan limit

From the pipeline or an agent

The same config works in the deploy step, in an MCP client such as Claude Code, and in the form above. create_monitor needs an organization-wide API key. If you omit regions, the plan picks its default.

{
  "name": "Company domain",
  "type": "domain",
  "interval_seconds": 300,
  "config": {
    "domain": "example.com",
    "expected_ns": ["ns1.example.net", "ns2.example.net"],
    "warn_days": 30
  }
}

Every interface, with its boundary

Limits

The expiry comes from WHOIS and can be unavailable. There is no RDAP. A TLD without an IANA referral, or with an answer the parser does not understand, reports expiry unknown and stays ok.
No registrar lock and no transfer status are read.
The RRSIG warning threshold is fixed at 3 days. warn_days applies to the registration only.
There are no address families and no per-address sub-results. Nameservers are asked over IPv4 first and over IPv6 only as a fallback.
Individual records are not checked, and neither are SPF, DMARC, and CAA. The DNS record check covers records, and the DNS hygiene check covers SPF, DMARC, and CAA.
The parent’s delegation NS set is not compared with the apex NS set.

All check types