# Domain & SSL Monitoring Checklist

*A free VigilDog resource — vigildog.com. Use it on every domain you manage.*

The failures that take a site down silently are all knowable in advance: a domain expires, a
certificate lapses, a chain breaks after a change. This checklist is what to watch so none of them
surprise you (or your clients).

---

## 1. Per-domain (registration)

For every domain:

- [ ] **Expiry date** recorded from the registry (RDAP/WHOIS), not just the registrar dashboard.
- [ ] **Auto-renew** is ON — and the **payment method on file is valid** (expired cards are the #1 cause of a "renewed" domain lapsing).
- [ ] **Registrant email** is a monitored inbox (not a former employee / privacy relay nobody reads).
- [ ] **Registrar lock** (transfer lock) is ON to prevent unauthorized transfers.
- [ ] **Renewal reminders** exist independently of the registrar (calendar + monitoring).
- [ ] For critical domains: consider a **multi-year registration** to reduce lapse risk.

**Alert timing:** T-45, T-14, and T-7 days before expiry. Recovery gets expensive fast once a
domain enters the redemption period.

## 2. Per-hostname (SSL/TLS certificate)

For every hostname that serves HTTPS — including **subdomains and APIs**, not just the apex:

- [ ] **Expiry date** of the live certificate, with an alert threshold (T-30 / T-14 / T-7).
- [ ] **Complete chain** — the intermediate certificate is installed (desktop browsers may cache it and hide a problem mobile clients will hit).
- [ ] **Hostname match** — the certificate covers the exact hostname (and `www` / apex as needed).
- [ ] **TLS version** — TLS 1.2 and 1.3 enabled; 1.0/1.1 disabled.
- [ ] **Auto-renewal** (Let's Encrypt/Certbot/ACME) is actually running — verify the cron/timer, not just that it was set up once.
- [ ] **Redirects** — HTTP → HTTPS is enforced; no mixed-content warnings.

## 3. After any change

Re-check the above whenever you:

- [ ] Migrate hosting or change the origin server.
- [ ] Edit DNS (A/AAAA/CNAME) or move nameservers.
- [ ] Transfer the domain between registrars.
- [ ] Add a new subdomain or API endpoint.

## 4. Cadence

- **Weekly:** scan the portfolio for anything within 30 days of expiry (domain or cert).
- **Monthly:** verify auto-renew + payment methods; spot-check chains on key hostnames.
- **On every change:** run section 3.

---

## Automate it

Running this by hand across a portfolio does not scale — and the one you forget is the one that
lapses. **[VigilDog](https://vigildog.com/monitoring)** watches domain expiry, SSL/TLS certificates,
DNS and email deliverability across every domain you manage, and warns you days before anything
breaks — with white-label reports for clients. Your first domain is free forever:
**https://vigildog.com/signup**