What to watch, and how alerts avoid false alarms

Which watch kinds cover a domain end to end, and how confirmation and buckets keep the noise down.

A watch re-runs one check on a schedule and tells you when the answer changes. The point is not the check itself, which you could run by hand, but the timing: certificates expire on a Sunday, domains lapse while the person who registered them is on leave, and DNS gets changed by someone who did not know it mattered.

A sensible set for one domain

Watch	What it catches
Website (HTTP) on the canonical URL	Outages, broken redirects, expired certificates
Certificate expiry on each HTTPS host	Renewal failures, 30/14/7/1 days ahead
Domain expiry and registrar	Lapsing registrations, unexpected registrar or status changes
DNS records changed at the apex	Nameserver moves, hijacked or mistaken record edits
Mail server (SMTP) on the domain	MX outages and STARTTLS failures
Blocklist listing on the sending address	Reputation problems before customers report bounces

How confirmation works

Uptime kinds (website, port, ping, DNS answer, mail server) need two failed checks in a row before an alert, with the second check about a minute after the first. One timeout is not an outage. Expiry and change kinds alert on the first confirmed result, because a certificate with seven days left is a fact, not a blip.

Expiry buckets

Expiry watches alert once per threshold as the date approaches: at 30, 14, 7 and 1 days. Each threshold is its own incident, so you see the escalation, and renewing clears it with a "Recovered" message.

Where alerts go

Every alert goes to your account email. Pro plans can add HTTPS webhooks, signed so your receiver can verify them, which is the simplest way into Slack, Teams or a ticketing system.