Your domains, watched quietly.

Nothing to start. The free plan watches 10 domains with the expiry and “renewal looks late” alerts, checked daily, and the one-off checks and the chart builder are free for everyone.

Paid plans watch up to 1,000 domains and add certificates checked every hour, alerts for SPF that mail servers reject and DMARC reports that won’t be delivered, more people to alert and client groups with a monthly report for each: Plus $15, Agency $49 and MSP $99 a month, or 10 months’ price for a year.

The pricing page has the details.

Certificates: An email as a certificate’s expiry gets close: 7, 3 and 1 day before for the certificates software renews, 30, 14, 7, 3 and 1 for the ones renewed by hand. “Renewal looks late”: an email when a certificate hasn’t renewed by the time its site usually renews, learned from that site’s own habit. A certificate that stops being valid: no longer trusted, or no longer matching the name. The server addresses behind a name, up to 4 IPv4 and 4 IPv6, the same ones each day, not just the first that answers; the valid certificate that expires soonest sets the alerts. A load balancer behind one address can still hide a bad server on a given day.

The domain: When the registration runs out: an email at 30, 14, 7, 3 and 1 day, where the registry publishes the date.

DNS and email: An SPF record that mail servers reject: over its 10-lookup limit, published twice, or with a part they can’t read. (paid plans) DMARC reports sent to another domain that hasn’t agreed to take them, or to one that has lapsed, and two DMARC records where there should be one. (paid plans)

Scheduled jobs: A link for each job to call when it runs, checked every 5 minutes: an email when a run is late, and another when it’s back.

On purpose. A healthy renewal sends nothing. You hear from us when a certificate’s renewal looks late, then again as its expiry gets close, once if the certificate breaks, and once if we can’t reach the site for 3 days. Domain registrations get 30, 14, 7, 3 and 1 days. Quiet means nothing is due.

No. A problem gets one email: if it clears and comes back within a day, it’s the same problem, so a certificate that flaps sends one email, not one a check. A scheduled job gets an email when it’s late and another when it’s back; if it misses again within a day, one more, then nothing until it has run on time for a day.

Then alerts about a broken or unreachable site wait until it’s healthy again, and any that no longer apply are dropped, so a fault on our side never reaches you as one on yours. Expiry alerts still go out: a date doesn’t depend on our checker.

Things that need no action today, gathered in one email a day at most, only on days that have any.

Open “Manage watched domains” at the bottom of any Expiry Watch email, your confirmation included, and add the job: a name, how often it runs and how late it may be. You get a link for the job to call each time it runs, with examples for cron, systemd timers and GitHub Actions.

We check every 5 minutes. A job that hasn’t called by its time plus the grace gets an email, and another when it’s back. A job that has never called is never late, and we keep only when each call arrived, never what it sent.

The free plan checks 1 job, and the paid plans up to 200.

Certificates that last 100 days or less are renewed by software, usually with about a third of their life left. Until we have seen your domain renew on time twice, we call a renewal late once an eighth of the life is left: 11 days for a 90-day certificate, 8 for a 64-day one. After that we follow your domain’s own habit, so a site that renews with 30 days to spare hears from us at 22. Reminders follow at 7, 3 and 1 day where there is room for them, so a 64-day certificate gets 3 and 1.

A six-day certificate gets its warning in its last day, and a daily check can use most of that up: certificates that short need the hourly checks of a paid plan.

Longer certificates are renewed by hand, so they get 30, 14, 7, 3 and 1 days.

The next check sends the most urgent alert already due (for a certificate that should have renewed by now, “renewal looks late”; for a registration, the 14-day one), and the rest follow on schedule. You don’t get a burst of old alerts.

We keep the last good result, say the check failed, and never call that an expiry or a fix. If we can’t reach the site for 3 days in a row, you get one short note.

It alerts; it doesn’t renew anything, and an email can land in spam or arrive after you needed it. Renewing is still up to you.

Checks run from one server, once a day at about 06:00 UTC (certificates every hour on a paid plan). They read the certificates public domain names serve on port 443 and their public DNS records. Mail servers, other ports and internal hosts are out of scope, and a CDN can serve other regions a different certificate.

If a busy day would exceed our sending limit, the most urgent alerts go first and the rest follow the next day.

Use “Stop watching” in an email about that domain: it opens a page about that domain alone, where one button stops it while the rest keep their alerts. To see every domain you watch, press “Manage my plan” on that page: we email you a sign-in link, and that browser stays signed in for 14 days. Every email also has a one-click unsubscribe from everything. Each takes effect immediately.

Your email address, the domains you watch, and what each check found (kept for 90 days), and for each scheduled job its name, its schedule and when it last called, never what the call sent or where it came from. We use the address only for these alerts and the confirmations around them.

Yes, with any certificate a public site serves. Let’s Encrypt stopped sending its own expiry reminder emails on June 4, 2025, which is one reason this exists.