DNS resolution and HTTP/HTTPS reachability, the SSL certificate itself (issuer, expiry, chain, and whether it actually matches this domain), the domain's own registration expiry, registrar and nameserver changes, DNS record changes (A, MX, nameservers), and SPF/DKIM/DMARC email security.
They're different failure modes. A certificate expiring is usually a quick fix; losing a domain because its registration lapsed, or its registrar or nameservers changed without you doing it, is a much bigger problem - and neither shows up in an SSL check. We check them independently so a clean certificate never gives a false sense of security about the domain itself.
A single 0-100 number and a letter grade, A through F, for each domain. It starts at 100 and loses points for confirmed problems - an expiring cert, an incomplete chain, a missing DMARC record - never for something we simply don't know yet (an unreachable WHOIS server, for instance). Every deduction is listed by name, so the score is always explainable, never a black box.
Both are available. The dashboard gives you a fleet-wide view at a glance, and on paid plans you also get a PDF emailed automatically once a month - every domain's risk score, what changed, and what's coming up for renewal - filed the way a compliance report would be.
Yes. Every check is kept, and each domain's page shows an at-a-glance health bar of recent checks plus a response-time trend, so you can spot a pattern (a flaky HTTP server, a slow renewal) rather than just today's snapshot.
No. Each problem fires exactly one email when it starts, then stays quiet until it's actually fixed or gets worse. Fixed sends its own "all clear" email - you won't get a second "certificate expired" email for a certificate that's still just as expired as before.
Two ways. Threshold-based: when a certificate or the domain's own registration crosses a warning line you've enabled (a set number of days or hours out, or the moment it actually expires). Change-based, always on regardless of thresholds: DNS stops resolving, HTTP or HTTPS stops working, a certificate chain becomes incomplete or its hostname stops matching, a registrar or nameservers change, DNS records change, or SPF/DKIM/DMARC records change.
The account owner always does. Beyond that, any teammate you've invited can be individually toggled on to also receive alerts, on every plan, for everyone on your team. You can also add a limited number of extra email addresses that aren't tied to a team member account, which is what your plan's recipient limit governs.
Yes. Every domain can override the account's default thresholds and recipients, useful for a domain that needs a different owner's attention, or one that's less critical and can use a lighter set of thresholds. A reset button puts a domain (or, from the account settings page, every domain at once) back to inheriting the account defaults.
An owner can do everything, including billing and inviting teammates. An administrator can manage domains and notification settings, but not billing or the team. A viewer can see everything but change nothing. Exactly one owner exists per account.
From Settings → Users & Roles, available from Starter up. Enter their email and pick a role. They get an email invite, and if they don't have an Upkeep account yet, signing up with that exact email address joins them straight into your account with the role you chose.
Yes. The Activity page logs domains added or removed, notification and recipient changes, invites sent, and role changes, along with who did it and when.
Mainly how many domains you can monitor and how many teammates you can invite - see the comparison table on the pricing section. Per-domain alert overrides are available from Starter up; Free is limited to the account-wide defaults only.
Adding another domain is blocked with a clear message telling you to upgrade. Nothing gets silently dropped or half-added.
Yes, any time, from Settings → Company. If you downgrade below your current domain count, we keep your oldest domains up to the new plan's limit and remove the rest, with a warning before it happens.
If you manage domains for multiple separate companies, the MSP plan lets you switch between client accounts from one login, each with its own domains, history, and alerts. Get in touch and we'll set it up for your business.