Watch your domains
Check every domain's registration expiry and email authentication on a schedule, and alert chat or a paging service before a lapse or a broken record takes it down.
Last updated
After reading this guide, you will know
- What guides build a domain monitor, and in what order to follow them
- How the expiry sweep and the email-authentication audit run on cron triggers
- When each check alerts, and when an alert pages someone
By the end of this recipe your app checks every domain it tracks on a schedule: its registration expiry over RDAP, and the DMARC, SPF and DKIM records receivers judge its mail by. A renewal reminder or a record that stopped passing reaches your chat, and a domain about to stop resolving pages whoever is on call.
Set up the queue and the dispatcher
Both checks run as jobs, so the queue, the dispatcher and the Worker's scheduled handler come
first. Follow Background jobs and cron.
Connect chat and paging
The checks hand every alert to the delivery job, so it exists before them. Follow
Send alerts to chat and paging services through
Fan out by severity, whose
notifyTeam sends critical messages to paging channels and everything to chat. A job passes
the dispatcher from ~/app/initializers/dispatcher as its enqueuer.
Watch registration expiry
Follow Watch when a domain expires, which sweeps
your domains every hour. Its Domains.alertExpiry builds a Message keyed
expiry:<domain> and passes it to notifyTeam: critical when needsAlert fired for an
expired domain or a status that stops it resolving, and warning for a renewal reminder, so a
reminder stays in chat.
Audit email authentication every day
Follow Check a domain's email authentication
through
Run the audit off the request,
which audits one domain per job. Schedule a daily job that enqueues one audit per domain with
sdxc make job sending-domains/audit-all --cron "0 6 * * *". Its handler reads every domain from SendingDomains and calls
dispatcher.enqueueMany(jobs.sendingDomains.audit, …) with one { domainId } each, so a
resolver that times out retries that domain alone. In the audit job, compare the new findings
with the stored ones before saveFindings: a check that passed and now fails sends a warning
keyed email-auth:<domain> through notifyTeam, and a domain whose checks all pass again sends
the same key with state: "resolved".
Test it
Test each stage as its guide does: Test the decisions checks when an expiry alerts, and Test the checks answers the DNS lookups each audit makes.
Where to go next
Custom domains for your customers — prove a customer owns a domain before you start watching it.
Retry on a growing delay — the schedules behind the sweep's and the delivery job's retries.
Read DMARC aggregate reports — see who sends mail as your domain once its records pass.