Domain and DNS: the outages hiding at your registrar
Your code can be flawless and your servers healthy while an expired domain or a bad DNS change takes everything offline. Here's how to watch the layer that lives outside your infrastructure.
Some of the most embarrassing outages have nothing to do with your servers. The code is fine, the database is up, the deploy went perfectly — and the whole site is unreachable because a domain lapsed or a DNS record changed. This layer lives outside your infrastructure, which is exactly why it’s so easy to forget until it bites.
The domain you forgot to renew
Domain registration expiry is the purest example of a fully preventable, self-inflicted outage. It happens on a date you already know, yet it still takes sites down — the renewal email went to an inbox nobody checks, the card on file expired, the person who registered it left. Monitoring domain expiry (via WHOIS) and alerting well ahead of the deadline turns a catastrophe into a calendar reminder.
DNS: small change, big blast radius
DNS is high-leverage and unforgiving. A single fat-fingered record, a propagation delay, or a nameserver problem can send users to the wrong place — or nowhere. And because resolvers cache, the damage can be uneven: fine from your desk, broken for a whole region. Watching resolution from multiple regions catches the geographically-partial failures a single check would miss.
What to actually watch
- Domain expiry — alert at comfortable intervals before the date, not the day of.
- DNS resolution — confirm the hostname resolves, and to the address you expect, from multiple regions.
- Nameserver reachability — a downed or misconfigured nameserver is an outage even if the domain is valid.
- Certificate expiry alongside it — domain, DNS, and TLS fail in adjacent ways; watching them together closes the whole “outside your servers” gap.
Why a single check isn’t enough
Resolution and reachability are relative to where you check from and which resolver you hit. A record change that looks fine locally can be broken elsewhere due to caching and propagation. Confirming from multiple regions separates “DNS is genuinely broken” from “my resolver hasn’t caught up yet” — the same multi-region logic that keeps uptime alerts honest.
The bottom line
The registrar and DNS layer sits outside your codebase, which is why healthy infrastructure is no guarantee. Watch domain expiry, DNS resolution, and nameserver reachability — from multiple regions, with certificate expiry alongside — and you close the gap where perfectly good servers still end up unreachable.
Never be surprised by an expiry again. Explore SSL & domain monitoring →
