> ## Documentation Index
> Fetch the complete documentation index at: https://docs.overwatchapp.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# TLS and DNS monitors: track cert expiry and record changes

> Monitor SSL certificate expiry and DNS record integrity with Overwatch. Get alerted before certs expire or DNS records change unexpectedly.

An expired TLS certificate or a quietly changed DNS record can take a service offline or redirect traffic without any obvious signal. TLS monitors check your certificates on a regular interval and warn you before they expire. DNS monitors verify that the records for a hostname remain exactly as expected, alerting you if a record goes missing or its value changes.

## TLS monitors

A TLS monitor connects to a host and port, retrieves the TLS certificate, and evaluates its validity and time to expiry. No HTTP request is made — the check is purely at the TLS handshake level.

### Config fields

<ParamField path="host" type="string" required>
  The hostname whose certificate you want to monitor. For example, `api.example.com`.
</ParamField>

<ParamField path="port" type="number" default="443">
  The port to connect to. Defaults to `443`. Set this to a non-standard port if your service uses one.
</ParamField>

<ParamField path="interval" type="number" required>
  How often to run the check, in seconds.
</ParamField>

### Status values

| Status          | Meaning                                                    |
| --------------- | ---------------------------------------------------------- |
| `active`        | Certificate is valid and not close to expiry.              |
| `expiring_soon` | Certificate is valid but approaching its expiration date.  |
| `expired`       | Certificate has passed its expiration date.                |
| `no_cert`       | No TLS certificate was found, or the TLS handshake failed. |

<Note>
  The threshold for `expiring_soon` is determined by configurable warning levels. Overwatch will alert you with enough lead time to renew the certificate before any service impact.
</Note>

### Create a TLS monitor

```bash theme={null}
curl -X POST https://overwatchapp.dev/api/v1/monitors \
  -H "Authorization: Bearer ow_live_sk_<secret>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "api.example.com certificate",
    "type": "TLS",
    "config": {
      "host": "api.example.com",
      "port": 443,
      "interval": 3600
    }
  }'
```

<Tip>
  Certificate expiry doesn't change minute-to-minute. An interval of 3600 seconds (1 hour) or higher is usually sufficient for TLS monitors, which reduces unnecessary check volume.
</Tip>

## DNS monitors

A DNS monitor resolves a hostname and checks whether the expected records are present and unchanged. If the record disappears or its value is different from what Overwatch last saw, the status changes accordingly.

### Config fields

<ParamField path="hostname" type="string" required>
  The fully qualified domain name to resolve. For example, `app.example.com`.
</ParamField>

<ParamField path="interval" type="number" required>
  How often to run the check, in seconds.
</ParamField>

### Status values

| Status    | Meaning                                                                           |
| --------- | --------------------------------------------------------------------------------- |
| `present` | The DNS record resolves as expected.                                              |
| `missing` | The DNS record could not be resolved.                                             |
| `changed` | The DNS record resolved, but its value differs from what was previously recorded. |

### Create a DNS monitor

```bash theme={null}
curl -X POST https://overwatchapp.dev/api/v1/monitors \
  -H "Authorization: Bearer ow_live_sk_<secret>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "app.example.com DNS",
    "type": "DNS",
    "config": {
      "hostname": "app.example.com",
      "interval": 300
    }
  }'
```

## Check intervals and plan limits

Check intervals for TLS and DNS monitors follow the same plan-based minimums as HTTP and TCP monitors.

| Plan       | Minimum interval  |
| ---------- | ----------------- |
| Starter    | 5 minutes (300 s) |
| Pro        | 1 minute (60 s)   |
| Enterprise | 10 seconds        |

<Note>
  Enterprise plans support 10-second check intervals for all monitor types, including TLS and DNS. Contact us to discuss Enterprise pricing if you need high-frequency certificate or DNS checks.
</Note>