Know What's Exposed.Fix What Matters.
CertNotify gives you one unified view of your internet-facing assets, applications and code — continuously detecting security risks, prioritising what matters, and telling you what to fix before it becomes an incident.
Monitor everything. Find risks early. Act before your users notice.
| Asset | Check | Status |
|---|---|---|
| certnotify.com | Certificate | 74d left |
| api.shopify.io | Certificate | 12d left |
| dashboard.vercel.co | DMARC | p=none |
| checkout-svc | Dependencies | 2 critical |
| infra/prod.tf | IaC | Passing |
| legacy-infra.net | Domain | Expired |
Up and running in under a minute
No complex setup. No agents to install. No credit card.
Enter any domain
Type a domain and get an instant report on SSL validity, expiry date, TLS version, DNS records, and email authentication. No account needed.
Add it to monitoring
Create a free account and add your domains to the dashboard. CertNotify checks them every 24 hours and logs changes over time.
Get alerted early
Receive email or WhatsApp alerts at 30, 14, and 7 days before expiry — and immediately if DNS changes or your site goes down.
Everything in one place
From certificate discovery to real-time alerting — the full security lifecycle, covered.
SSL Certificate Monitoring
Track certificate chain integrity, issuer details, and expiry dates across all your domains. Alerts fire at 30, 14, and 7 days before expiry — giving your team time to renew without triggering a browser warning or causing a service outage.
Domain Expiry Tracking
Monitor domain registration expiry via live WHOIS data. Know before your domain lapses and your brand is at risk.
TLS Configuration Audit
Detect outdated TLS 1.0/1.1, weak cipher suites, and misconfigured certificates with actionable remediation steps.
DNS & DNSSEC Validation
Verify DNS record integrity and DNSSEC implementation. Detect propagation issues across global resolvers.
Email Authentication
Validate SPF, DKIM and DMARC so spoofed mail cannot be sent in your name — and policy gaps do not go unnoticed.
Code & Supply Chain
Scan for hardcoded secrets, vulnerable dependencies via the OSV database, and insecure Terraform, Kubernetes and Docker configuration.
Multi-Channel Alerts
Email and WhatsApp notifications configured to reach the right person at the right time. No alert fatigue.
What actually breaks, and when you find out
Almost nothing in this category fails cleverly. It is a date nobody was watching, or a record that changed and still looked correct from the inside.
Certificates fail closed, not gradually
A certificate does not degrade as its expiry approaches. It works completely until the moment it does not, and then every browser shows a full-page warning instead of your site. Renewal is usually automated, which is precisely why it fails quietly: a scheduled job that stopped running months ago, an ACME challenge that can no longer complete because a DNS record moved, or a certificate that renewed correctly on disk and was never reloaded by a web server still holding the old one in memory. Watching the certificate actually being served — rather than the job supposed to renew it — is what closes that gap. Alerts at 30, 14 and 7 days leave time to fix a broken renewal rather than time to panic.
An expired domain is worse than an expired certificate
A lapsed certificate is an afternoon of work. A lapsed domain is a negotiation. Once registration expires the name enters a redemption period with restoration fees attached, and in the meantime mail stops arriving, certificates cannot be reissued against a domain you no longer control, and anyone watching the drop lists can see it become available. Registrar reminders go to whichever mailbox was used at purchase, which is often a personal address belonging to someone who has since left. Reading the expiry date from WHOIS directly means the date you are alerted on is the one the registry holds, not the one sitting in an inbox nobody checks.
A wrong DNS record propagates as reliably as a right one
Resolvers cache what they are handed for the length of the TTL, so a change made in the morning surfaces for some users that afternoon and for others the next day — long after the deploy it accompanied was declared successful. DNSSEC has a sharper failure mode: when the chain of trust breaks, resolvers that validate refuse to answer at all, while resolvers that do not validate carry on as though nothing happened. The domain resolves perfectly from your desk and is unreachable for a slice of the internet you cannot see from there. Checking from outside your own network is the only way that shows up.
Email authentication degrades without telling anyone
SPF, DKIM and DMARC decide whether mail sent in your name is trusted, and all three drift. SPF is capped at ten DNS lookups by RFC 7208, and every SaaS vendor added to the record spends part of that budget — exceed it and the record fails permanently rather than gracefully. A DMARC policy of p=none collects reports and enforces nothing, which is the right place to begin and the wrong place to stay. Providers rotate DKIM keys on their own schedule. None of this surfaces as a bounce in your own testing, because you are not the one being asked to make the trust decision.
Subdomains outlive the things they pointed at
A staging host, a marketing microsite, a status page on a vendor that was cancelled two budgets ago — the DNS record for each of those usually survives the service it was created for. A CNAME still pointing at a deprovisioned bucket or app platform is a subdomain takeover waiting for whoever claims that name next, and it will serve their content under your domain, over a certificate they can legitimately obtain for it. Nothing about this looks wrong in your own dashboards, because the subdomain is not one you think about any more. Enumerating what actually resolves under a domain, and checking whether each target still belongs to you, is the only thing that finds them.
The code you ship is part of the same surface
Credentials committed to a repository remain in its history long after the file is deleted. Dependencies acquire published vulnerabilities without a line of your own code changing. Infrastructure written as Terraform, Kubernetes manifests or a Dockerfile encodes a security posture that nobody re-reads once the pull request is merged. Secret scanning, dependency checks against the OSV database and configuration analysis are aimed at the same attack surface as your certificates and DNS records, so they belong in the same view rather than in a separate tool somebody remembers to run.
The checks are open, so the findings are auditable
The scanning engine is published as an AGPL-3.0 package carrying 14 of these checks, and it runs with npx against your own domains without an account here at all. A tool that asks you to act on its findings should be willing to show how it reached them — including the cases where a check is inconclusive rather than clean. What runs on the hosted dashboard is the same code, on a daily schedule, with history kept so you can see when something changed rather than only that it is wrong now.
69 free security checker & lookup tools
Check any domain, or scan your own code for secrets, vulnerable dependencies and insecure infrastructure — no account required.
Public IP, ISP, location & VPN status
Certificate validity, expiry & chain
Domain registration & expiry data
A, MX, TXT, NS, CNAME records
Inspect raw HTTP response headers
Email security & anti-spoofing setup
Live availability & response time
Sender Policy Framework lookup
DKIM signing record validator
Autonomous System Number info
Threat intel & blacklist check
PTR record & hostname lookup
Find hardcoded keys & credentials
Known CVEs in your packages + SBOM
Terraform, Kubernetes & Docker config
Decode & inspect JSON Web Tokens
Format, validate & minify JSON
Every email record, scored
Find subdomains via CT logs
Find dangling CNAME records
Find registered typosquats
Find missing intermediates
CVE & GHSA vulnerability search
What an anonymous caller sees
See all tools →Simple, honest pricing
The tools are always free. Pay only when you need ongoing monitoring.
- 20+ security tools, unlimited scans
- SSL, DNS, WHOIS, DMARC checks
- No signup for tool use
- Up to 3 domains monitored
- Email expiry alerts
- Everything in Free
- Unlimited domain monitoring
- WhatsApp alerts
- Daily automated checks
- Certificate chain history
- Priority support
Frequently asked questions
Still have questions? Contact us.
How does SSL certificate monitoring work?
CertNotify connects to your domain and inspects the SSL/TLS certificate — issuer, expiry date, certificate chain, and TLS version — when you add it to your dashboard. We re-check it automatically every day and alert you when expiry is approaching.
How far in advance will I be alerted before my SSL expires?
You receive alerts at 30 days, 14 days, and 7 days before expiry. You can adjust these thresholds in your dashboard settings.
Do I need an account to use the free tools?
No. All 20+ tools — SSL checker, DNS lookup, WHOIS, DMARC, SPF, DKIM, and more — are completely free with no signup required. An account is only needed for ongoing daily monitoring and alerts.
What is the difference between a one-time scan and monitoring?
A scan gives you an immediate report for a single check. Monitoring adds the domain to your dashboard where CertNotify re-checks it every 24 hours and alerts you automatically before anything expires or breaks.
Does CertNotify store my domain data?
We store the domain name and certificate metadata (issuer, expiry date, TLS version). We never log certificate contents or any private key material. See our privacy policy for the full details.
Can I receive WhatsApp alerts as well as email?
Yes. WhatsApp alerts are available on paid plans. Once connected, expiry warnings and downtime alerts are delivered directly in WhatsApp alongside your email notifications.
SSL & security guides
Fix errors, understand TLS, and harden your stack.
Start monitoring before something goes wrong.
Add your domains once. CertNotify watches them every day and alerts you well before any certificate expires or DNS change breaks your site.