The probe network

Six probe regions, one per inhabited continent. This page is the architecture: how a check runs, how regions vote, and what has to agree before anyone is woken up.

The regions

One region per inhabited continent, all six active. Free plans probe from 2 regions, Pulse from 3, Sentinel and up from all six. The region codes above are the same codes you see in the product, in the sample SLA report, and on your status pages.

How a check runs

Probe nodes pull work from the control plane rather than being pushed to: each node asks every few seconds for the checks that are due in its region, runs them, and reports the full result. A node that goes silent stops taking work; it cannot silently drop your checks.

Each node runs its own recursive, validating DNS resolver. That means DNS results are measured against the real DNS tree, not against a public resolver’s cache, and dns_ms is reported separately from total latency, so a slow resolver never masquerades as a slow application. Checks run dual-stack across all A and AAAA records with per-IP results.

Every failure is attributed to a layer before it reaches you: your application, your DNS, the network in between, our resolver, or our own probe node. When the fault is on our side, the record says so.

How regions vote

Two thresholds sit between a failed check and your phone:

1. Within a region: 75% of the region’s probe nodes have to agree before the region votes at all. One node disagreeing with its neighbors is recorded as drift, not as an outage.
2. Across regions: an incident opens only when a quorum of regions confirms the failure, two regions by default, with a separate quorum for confirming recovery. Results older than the freshness window do not count toward quorum.

Below quorum, nothing is silently swallowed: a forming incident is visible in the product with the first failing region named, and sub-quorum divergences (one region drifting, one IP family failing, one node disagreeing) land on a watchlist instead of paging anyone. A watchlist entry has to survive a full check interval before it is even reported.

The incident’s start time is the quorum confirmation, to the second. It is the same boundary your availability record uses later.

What we deliberately do not publish

Node IP addresses and hosting providers are not listed here; probe egress details are available to customers who need them for allowlisting, on request. The probe nodes hold no customer account data: they measure and report, and the control plane stays in the EU under a German company. The rest of that story is on the security page.

Take the tour, or see the check types the fleet runs.