Domain and DNS checks
Ten checks on the layer underneath the website, where the failures are rarer and considerably worse. Domain expiry and nameserver changes are the ones that end a business rather than a ranking. The email trio - MX, SPF and DMARC - is the sleeper: when those drift, transactional mail stops arriving and nothing anywhere reports an error. All ten are DNS lookups, so they are cheap and run once per domain.
Nameservers are the hijack signal. A records are not.
A domain takeover shows up as the nameservers changing. That does not happen on its own, which is why the check is on by default and confirms quickly.
A and AAAA records are a different story, and this check is off by default because of something found while dogfooding: crawlwarden.com’s own A records changed between two probes minutes apart, because Vercel rotates IPs. Cloudflare does the same. At a normal confirmation threshold this check would alert constantly on most customer sites, which is most of the web now. It is available, it is slow to confirm, and it is off unless you know your hosting holds still.
The email trio is the one people regret not watching
MX, SPF and DMARC have exactly the same failure shape as the rest of this product: something changes, nothing breaks visibly, and the cost accrues quietly for weeks. A DMARC policy moved to p=reject while SPF is misconfigured silently bins your own password resets and receipts. An MX edit made for one mail provider routes away from another. The bounce reports go to an address nobody reads.
Domain expiry is a threshold, not a comparison
Almost every check here reports that a value changed. Domain expiry and certificate expiry instead report a number crossing a line, because "it is the same date it was yesterday" is not reassurance when the date is next week.
All 10 checks in this group
Domain expiry
on by default · per domain · confirmed over 2 runs
The domain registration is approaching expiry.
Days remaining against a threshold, read from RDAP. This is the failure that ends a business rather than a ranking.
Registrar
on by default · per domain · confirmed over 2 runs
The domain moved to a different registrar.
The domain moved to a different registrar. Either a planned migration, or the visible half of a transfer nobody authorised.
Nameservers
on by default · per domain · confirmed over 2 runs
The nameservers changed.
The real hijack signal, and the reason the A record check is not. Nameservers do not rotate on their own.
A / AAAA records
off by default · per domain · confirmed over 4 runs
The IP addresses the domain points at changed. Noisy on CDNs, which rotate them.
Off by default and slow to confirm, because CDNs rotate IPs. Our own A records changed between two probes minutes apart while we were testing this.
MX records
on by default · per domain · confirmed over 2 runs
Mail routing changed - email can stop arriving silently.
Mail routing changed. Transactional email stops arriving and nothing errors - the sleeper failure in this group.
SPF record
on by default · per domain · confirmed over 3 runs
The SPF record changed.
The record that decides whether your mail is accepted. An edit made to add one sending tool routinely breaks another.
DMARC record and policy
on by default · per domain · confirmed over 3 runs
The DMARC record or its policy changed.
Includes the policy, not just the record. Moving to p=reject with SPF or DKIM misconfigured silently bins your own mail.
DKIM selector
off by default · per domain · confirmed over 3 runs
A DKIM selector you declared changed.
Off by default; runs only for selectors you declare. A rotated or removed key fails signatures on everything you send.
CAA record
off by default · per domain · confirmed over 3 runs
The CAA record changed - controls who may issue certificates.
Off by default. Controls which authorities may issue certificates for the domain, so a change here precedes a certificate change.
DNSSEC
off by default · per domain · confirmed over 3 runs
DNSSEC was enabled or disabled.
Off by default. Enabled or disabled. Misconfigured DNSSEC takes a domain off the internet entirely, for everyone, at once.
Every check on this page is available on every plan, including the free one - limits are on sites and URLs, never on checks. CrawlWarden pricing, per site rather than per URL.