Guides

How things break, and how to know first: plain guides to each thing hostnag watches, with the check that catches it.

• Subdomain takeover explained: how a forgotten CNAME lets someone else serve your name

  26 Sep 2026

  A CNAME left pointing at a deleted Heroku app or S3 bucket lets a stranger serve your subdomain. How to find those records, and how to fix one.

• How to monitor a private host with a Beacon: one readable script, run by your own scheduler

  18 Sep 2026

  Watch an intranet host or an internal certificate from inside your network with one plain script, scheduled by cron, launchd or Task Scheduler.

• How to publish a status page that draws itself from your monitors

  18 Sep 2026

  A public status page drawn from the monitors you already run, with uptime strips, incidents the checks raise or you write, subscriber mail and badges.

• How to monitor SSL certificate expiry (and why 30 days is the wrong first alert)

  15 Sep 2026

  An expired certificate breaks browsers, APIs and mail at midnight. Why one 30-day reminder fails a 90-day certificate, and what to check beyond the date.

• What happens when a domain expires: the timeline from the date to the drop

  15 Sep 2026

  Expiry day, the renewal grace, 30 days of redemption at a premium, pending delete and the drop: what breaks at each step, and why a calendar entry fails.

• SPF, DKIM and DMARC explained: how to read the records and the mistakes that get mail rejected

  15 Sep 2026

  Read SPF, DKIM and DMARC records term by term, look them up with dig, and fix the mistakes that get legitimate mail rejected.

• How to monitor cron jobs with heartbeats: one curl line and a grace period

  15 Sep 2026

  A cron job has no address to check, so it checks in instead. One curl -fsS line at the end of the job, and a grace period sized to its slowest run.

• Ping is not uptime monitoring: what an ICMP reply proves, and why a failure needs a second witness

  15 Sep 2026

  An ICMP reply proves a machine is there. A TCP connect on the right port is the first real test, and a failure needs a second place to confirm it.

• How to check a mail server against blocklists (and why "not checkable" is not "clear")

  15 Sep 2026

  The four DNS blocklists that get mail refused, the dig command that checks an address, how to get delisted, and why an unanswered lookup is no pass.

• Certificate transparency explained: the public logs and the certificate you did not order

  15 Sep 2026

  Every public certificate for your domain is in the transparency logs. How to tell yours from one you did not order, and what to do about it.

• How to monitor a vendor's status page and get the incident title in your own alerts

  15 Sep 2026

  Paste a Statuspage, Instatus, Better Stack, incident.io or status.io page. A vendor outage turns Down on your board, and the alert carries the incident title.

• How to monitor an office internet link from both ends, so a filtered port and a dead line read differently

  15 Sep 2026

  Reach the gateway from the internet and have a device inside check in, so a filtered port, a dead line and a new public address each read differently.

• How to monitor private PKI, client, code-signing and S/MIME certificates that no scanner can reach

  15 Sep 2026

  Internal CA, client, code-signing and S/MIME certificates are served on no port. Post or paste them to a report URL for the same expiry ladder.