SSL Expiry and DNS Monitoring: A Checklist for Online Stores

To protect a store from SSL and DNS failures, monitor four things: when the SSL certificate expires, when the domain registration expires, whether the key DNS records still hold the right values, and whether the certificate chain is valid. Alert at least 30 days and again 7 days before any expiry. These failures are easy to prevent and costly to ignore.

An expired certificate makes browsers show a full-page warning. Many customers leave at that point. A wrong DNS record can send customers, or your order emails, nowhere.

Why these failures hurt

Both problems share a trait: they are silent until they break.

• A certificate works for months, then stops on a fixed date.
• A domain renews once a year, and a failed payment can go unseen.
• A DNS record changes during a migration, and nobody checks it afterwards.

When they fail, everything fails at once. The store, the checkout, the API calls, and sometimes the email too.

Part 1: SSL certificate checklist

An SSL/TLS certificate proves your domain identity and encrypts traffic.

Know your certificates

• List every hostname that needs a certificate: the main store, www, a checkout subdomain, an API host, a chat or widget host, a blog.
• Note who issues and renews each one: your host, the platform, a CDN, or you.
• Note the expiry date of each.

Platforms often renew certificates for you. Shopify normally provides SSL for connected domains. Many hosts use automatic issuance. Still, automatic renewal can fail, for example when DNS changes block the validation step.

Monitor expiry

• Add an expiry check for every hostname.
• Alert at 30 days and again at 7 days before expiry.
• Add a final alert at 2 or 3 days, sent to more people.
• Send alerts to a shared channel, not only to one person's inbox.

Monitor validity, not only the date

• Hostname match: the certificate must cover the exact hostname.
• Complete chain: a missing intermediate certificate breaks some clients while others work.
• Trusted issuer: the certificate must come from an issuer clients trust.
• Redirects: HTTP should redirect to HTTPS without loops.

Handle renewal

• If you renew by hand, put the date in a shared calendar with reminders.
• If renewal is automatic, still check that the new certificate is installed.
• After each renewal, load the site in a browser to confirm.

Part 2: Domain registration checklist

If the domain expires, you lose the store address.

• Turn on auto-renew at the registrar.
• Keep a valid payment method on file, and check its card expiry date.
• Use a shared role email for registrar contacts, not one person's address.
• Add a registrar lock, if offered, to guard against unwanted transfers.
• Add a domain expiry alert at 60, 30 and 7 days.
• Record who owns the registrar account. Many stores learn too late that a former agency holds it.

Part 3: DNS checklist

DNS tells the world where your store and your email live. Keep a written list of records you expect.

Records to know

• A and AAAA: point your domain to an IP address.
• CNAME: point a hostname to another name, such as www to the platform.
• MX: where incoming email goes.
• TXT: SPF, DKIM and DMARC for email, and verification codes for services.
• NS: which name servers are in charge.
• CAA: which certificate authorities may issue certificates. If you use CAA, make sure it allows your current issuer.

What to monitor

1. Resolution. Check that the main hostnames resolve at all.
2. Expected values. Compare records with your list. Alert on any change.
3. Name servers. Alert if the NS records change unexpectedly. This can signal a hijack or a mistake.
4. Email records. Check that MX, SPF, DKIM and DMARC are present. Broken email records push order emails into spam.
5. Propagation after changes. After any DNS change, check from several places, as caches take time to update.

Reduce risk when changing DNS

• Copy the current records before you change anything.
• Lower the TTL (cache time) ahead of a planned change, then raise it again after.
• Change one thing at a time.
• Check the site, the checkout and an order email after the change.
• Restrict who can edit DNS, and turn on two-factor login for the DNS account.

Part 4: Set up the alerts

You can monitor all of this with a mix of tools. Many uptime tools include SSL expiry checks and keyword checks. Uptrack (from the 2folk team) is one option among others. Dedicated DNS or domain monitors exist too. Check which tool covers certificate expiry, domain expiry and DNS record changes, since support varies.

Set clear ownership:

• One named owner for certificates.
• One named owner for the domain and DNS.
• A backup person for each.

Part 5: Test your process

• Once a year, run a drill. Ask: "If the certificate expired tomorrow, who would notice and who would fix it?"
• Check that alerts arrive in the right inbox.
• Confirm you still have access to the registrar and DNS accounts.

The full checklist

• All hostnames listed, with issuer and expiry date.
• Certificate expiry alerts at 30, 7 and 2 or 3 days.
• Chain and hostname validity checked.
• HTTP to HTTPS redirect works without loops.
• Domain auto-renew on, payment method valid.
• Registrar contact is a shared role email.
• Domain expiry alerts at 60, 30 and 7 days.
• Written list of expected DNS records.
• Alerts for DNS value changes and name server changes.
• Email records (MX, SPF, DKIM, DMARC) checked.
• Two-factor login on registrar and DNS accounts.
• Named owners and backups.

Frequently asked questions

How far ahead should I alert about certificate expiry?

Alert at 30 days and again at 7 days. Add a last alert at 2 or 3 days that goes to more people. This leaves time to fix a failed automatic renewal.

My platform manages my certificate. Do I still need monitoring?

Yes. Automatic renewal can fail, for example after a DNS change. A monitor tells you before customers see a warning.

What DNS records matter most for a store?

The A or CNAME records for the store, the MX record for email, and TXT records for SPF, DKIM and DMARC. Also watch the NS records, since a change there moves control of the whole zone.

What happens if my domain expires?

The store address stops working, and email on that domain can stop too. Registrars often give a grace period, but you cannot count on it. Turn on auto-renew and alert ahead of the date.