TLS and DNS monitors: track cert expiry and record changes

An expired TLS certificate or a quietly changed DNS record can take a service offline or redirect traffic without any obvious signal. TLS monitors check your certificates on a regular interval and warn you before they expire. DNS monitors verify that the records for a hostname remain exactly as expected, alerting you if a record goes missing or its value changes.

TLS monitors

A TLS monitor connects to a host and port, retrieves the TLS certificate, and evaluates its validity and time to expiry. No HTTP request is made — the check is purely at the TLS handshake level.

Config fields

string

required

The hostname whose certificate you want to monitor. For example, api.example.com.

number

default:"443"

The port to connect to. Defaults to 443. Set this to a non-standard port if your service uses one.

number

required

How often to run the check, in seconds.

Status values

Status	Meaning
`active`	Certificate is valid and not close to expiry.
`expiring_soon`	Certificate is valid but approaching its expiration date.
`expired`	Certificate has passed its expiration date.
`no_cert`	No TLS certificate was found, or the TLS handshake failed.

The threshold for expiring_soon is determined by configurable warning levels. Overwatch will alert you with enough lead time to renew the certificate before any service impact.

Create a TLS monitor

curl -X POST https://overwatchapp.dev/api/v1/monitors \
  -H "Authorization: Bearer ow_live_sk_<secret>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "api.example.com certificate",
    "type": "TLS",
    "config": {
      "host": "api.example.com",
      "port": 443,
      "interval": 3600
    }
  }'

Certificate expiry doesn’t change minute-to-minute. An interval of 3600 seconds (1 hour) or higher is usually sufficient for TLS monitors, which reduces unnecessary check volume.

DNS monitors

A DNS monitor resolves a hostname and checks whether the expected records are present and unchanged. If the record disappears or its value is different from what Overwatch last saw, the status changes accordingly.

Config fields

string

required

The fully qualified domain name to resolve. For example, app.example.com.

number

required

How often to run the check, in seconds.

Status values

Status	Meaning
`present`	The DNS record resolves as expected.
`missing`	The DNS record could not be resolved.
`changed`	The DNS record resolved, but its value differs from what was previously recorded.

Create a DNS monitor

curl -X POST https://overwatchapp.dev/api/v1/monitors \
  -H "Authorization: Bearer ow_live_sk_<secret>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "app.example.com DNS",
    "type": "DNS",
    "config": {
      "hostname": "app.example.com",
      "interval": 300
    }
  }'

Check intervals and plan limits

Check intervals for TLS and DNS monitors follow the same plan-based minimums as HTTP and TCP monitors.

Plan	Minimum interval
Starter	5 minutes (300 s)
Pro	1 minute (60 s)
Enterprise	10 seconds

Enterprise plans support 10-second check intervals for all monitor types, including TLS and DNS. Contact us to discuss Enterprise pricing if you need high-frequency certificate or DNS checks.

Get Started

Monitors

Alerts

Teams & Billing

TLS and DNS monitors: track cert expiry and record changes

TLS monitors

Config fields

Status values

Create a TLS monitor

DNS monitors

Config fields

Status values

Create a DNS monitor

Check intervals and plan limits

​TLS monitors

​Config fields

​Status values

​Create a TLS monitor

​DNS monitors

​Config fields

​Status values

​Create a DNS monitor

​Check intervals and plan limits

TLS monitors

Config fields

Status values

Create a TLS monitor

DNS monitors

Config fields

Status values

Create a DNS monitor

Check intervals and plan limits