hostnag

Domain monitoring

Every domain's registration watched for lapsing, a registry hold or a blocked renewal, plus whether its nameservers answer for it and agree, and whether its DNSSEC signatures are still fresh.

Start freeSee pricing

Included on every plan.

PlansFreeProBusiness
What Domain monitoring catches
What breakshostnag
A domain lapsesYes
Your nameservers or registrar changeYes

On the board

Each registration on its runway: the window spent, the days left, a tick per threshold.
  • example.com40 d left
  • acme-shop.example1 d left

How it works

  1. 01

    Add the domain

    A registrable domain, like example.com. hostnag looks it up in RDAP, the public successor to WHOIS.

  2. 02

    Thresholds, as for certificates

    The same 30, 14, 7, 3 and 1 day defaults, editable per group; the final window repeats daily.

  3. 03

    Read on every poll

    Registrar, nameservers and DNSSEC status are read on every poll (every 1440 minutes on Free, 60 on Pro, 15 on Business), so a domain years from lapsing is still watched.

  4. 04

    A change is its own alert

    A new registrar, new nameservers, or DNSSEC turned off each raise a Changed event the moment RDAP shows it, separate from the expiry countdown.

  5. 05

    Registry statuses and DNSSEC signatures

    Every poll reads the domain's registry statuses. A hold (the domain is taken out of DNS), a redemption period, a pending delete, a blocked renewal and a transfer under way each show up as a finding of their own. On a signed domain hostnag asks the zone's own nameservers for its signatures. An expired signature, or none at all, is critical; one inside the last 10 % of its window with under 24 hours left is a warning to check the signer.

  6. 06

    Nameservers that answer

    hostnag asks every nameserver the registry lists (up to 8) for the zone. None answering for it is critical; one that refuses, answers without authority or no longer exists is a warning that names it. So is a single nameserver, a registry list the zone itself disagrees with, and servers still giving different versions of the zone on two checks in a row. All of them on one network is a note. A server the probe cannot reach is never counted against you.

What you'll be told

What you get told

  1. [Info] example.com domain expires in 25 days

    The domain for example.com expires in 25 days (07 Oct 2026). Renew it before then.

    Domain

  2. [Critical] Registration of acme.example needs attention

    The registrar has put acme.example on hold, so it is not published in DNS.

    Domain

  3. [Warning] Nameservers for acme.example need attention

    acme.example is delegated to ns3.old-host.example, which refuses to answer for it. Resolvers that ask it get no answer. Fix it or remove it from the delegation at the registrar.

    Domain

  4. [Critical] DNSSEC for acme.example is failing

    A DNSSEC signature on acme.example expired at 2026-09-28 20:00 UTC. Validating resolvers cannot resolve the domain.

    Domain

  5. [Warning] Nameservers changed for api.example.com

    api.example.com is now delegated to ns1.evil.example, ns2.evil.example (was dns1.registrar-servers.com, dns2.registrar-servers.com). If you did not move DNS, treat this as a possible hijack.

    Domain

Sample alerts, rendered by the same code that writes your email and Slack messages.

Settings

History
a strip of days under the expiry runway, each Healthy, Needs attention or At risk by that day's registry and DNSSEC findings, on the monitor's History, the board's strip views and a status page
Target
a registrable domain
Interval
1440 min on Free, 60 on Pro, 15 on Business
Thresholds
30, 14, 7, 3 and 1 days by default, set per group
Tracked on every poll
registrar, nameservers and whether each answers, registry statuses, DNSSEC status and signatures

Questions

Does hostnag renew domains for me?

No. hostnag only watches and nags; it never touches your registrar account.

What if my registrar doesn't offer an API?

RDAP is public for every registrar, so there is nothing to connect or configure.

What is a registry hold?

A status the registrar or the registry sets that takes the domain out of DNS, often over an unpaid renewal, unverified contact details or a dispute. The websites and mail on it stop resolving while it lasts, so hostnag raises it as critical from the first poll that shows it.

What is a lame nameserver?

One the registry still lists for your domain that no longer answers for it: a DNS host you moved away from, a server that was switched off. Resolvers that pick it get no answer and try another, so the domain is slow or fails for some visitors and not others. The fix is to remove it from the delegation at the registrar, and hostnag's finding names the server.

Related

DNS monitoringThe records that point people and mail at your systems, watched for drift from the answer you told hostnag to expect.Certificate monitoringEvery certificate hostnag can reach is watched for expiry, a swapped chain and a renewal that should already have happened; the ones it cannot reach get a URL to report to instead.Discovery and subdomain watchEvery name under a domain, found in its own DNS, its homepage and the names people usually use, each judged live, gone or pointing nowhere, with the ones anyone could claim listed first. A subdomain watch looks again every day and alerts on what changed.

Read

What happens when a domain expires: the timeline from the date to the dropExpiry day, the renewal grace, 30 days of redemption at a premium, pending delete and the drop: what breaks at each step, and why a calendar entry fails.

Add a host. Hear about it first.

Start free