Domain monitoring

Domain monitoring watches the external surfaces your clients depend on, their website certificates, their DNS, their mail records, and alerts you before things visibly break.

Unlike most RMM features, domain monitoring doesn't need an agent. The checks run from OpsMerge's infrastructure, not from any endpoint.

What it monitors

For each domain you add, OpsMerge can run four checks. Each is a per-domain toggle:

Check	What it does
SSL certificate	Connects to port 443, verifies the chain, records issuer, subject, SANs, signature algorithm, and days to expiry
DNS	Resolves A, AAAA, MX, NS, and TXT records. A change to the NS or MX record set since the previous run raises a one-shot warning, catching hijacks and silent mail breakage
WHOIS	Domain registration expiry, registrar, nameservers, and registrar lock status. RDAP is queried first (direct to the registry via the IANA bootstrap), falling back to classic WHOIS for registries without RDAP. A transfer lock disappearing between runs raises a warning, a classic hijack precursor
DMARC / SPF	Checks the SPF record at the domain root and the DMARC record at _dmarc.{domain}, including the DMARC policy

All enabled checks run together on the monitor's schedule, daily by default. Expiry signals move over months, so daily is the right cadence for almost everyone; you can shorten the interval per-monitor (minimum 60 seconds), and Check Now on the domain's page covers on-demand runs.

Adding a domain

Monitoring → Domain Monitors → Add Monitor.

1. Enter the domain (e.g. acmecorp.co.uk), no scheme, no path.
2. Optionally pick the client it belongs to. Client-linked monitors use that client's alert template.
3. Tick which checks you want (SSL, DNS, and WHOIS are on by default).
4. Set the warning thresholds: days before SSL expiry and days before domain expiry to start warning (default 30).
5. Save.

The first check runs within five minutes. Results appear on the domain's page.

Statuses and alerting

Each check reports OK, Warning, or Error; the monitor's overall status is the worst of its enabled checks.

• Warning — expiry is inside your configured warning window, one of SPF/DMARC is missing, the NS or MX records changed since the last run, or the domain's transfer lock was removed.
• Error — expired, expiry within 7 days, the certificate fails validation, DNS fails to resolve, both SPF and DMARC are missing, or the check itself could not complete.

Change-detection warnings (NS/MX drift, lock removal) are one-shot: the next run compares against the new state, returns OK, and the alert auto-resolves, so a legitimate DNS migration warns once rather than nagging until someone acknowledges it.

Alerts flow through the standard OpsMerge alert engine: the alert template hierarchy (client's template, then org default) decides the notification channels. An alert resolves automatically when the check returns to OK, and a warning that escalates to error re-notifies. Domain alerts appear on the Alerts page alongside everything else, under the Domain monitor source.

Check history

The domain's page keeps a history of status transitions, when a check moved between OK, warning, and error. Steady-state runs aren't logged (a daily "still fine" entry is noise), and history is retained for 90 days. The snapshot cards at the top of the page always show the latest data regardless.

Pausing

Pause a monitor to stop scheduled checks without deleting its configuration and history, useful during planned migrations or when a domain is intentionally being wound down. Paused monitors don't alert.

Common issues

Cert expiry alert keeps firing after renewal. Checks run on the monitor's schedule (daily by default), so a same-day renewal won't reflect until the next run. Use Check Now on the domain's page. If it still reports a problem, the served chain may be missing an intermediate; verify with openssl s_client -connect yourdomain:443.

WHOIS shows a blank registrar. Some registries redact registrar details (GDPR) or serve terse records. The expiry date is almost always still available, which is the part that matters.

DMARC says "no record" but I just added one. DNS propagation. Wait for TTL expiry and use Check Now. Also confirm the record is published at _dmarc. on the apex, not on a subdomain.

SSL check errors on a domain that doesn't serve HTTPS. The SSL check dials port 443 on the monitored name. For mail-only or parked domains, disable the SSL toggle on that monitor.

Missing SPF/DMARC flagged on a domain that sends no mail. The DMARC/SPF check is a toggle, switch it off for domains with no mail function, or better, publish a null SPF (v=spf1 -all) and a reject DMARC record so the domain can't be spoofed.

Permissions

• domain_monitors.list — view monitors, snapshots, and history.
• domain_monitors.manage — create, edit, pause, delete, and trigger checks.

Next

• Monitoring & alerts — domain alerts use the same alert-template infrastructure