Your client’s domain expires in nine days. Which one?

Within seconds we run four checks against public infrastructure: we ask the registry when the domain expires (RDAP), open a TLS connection and read the certificate, resolve the A, AAAA, MX, NS and TXT records, and request the site over HTTP to see the status code and redirect chain. Then we repeat all of it once a day and compare against the previous result. You hear from us when something changes or a deadline gets close.

For domains: 60, 30, 14, 7 and 1 day before expiry, and you can change which of those rungs fire. Each rung sends once, so five domains expiring the same week don’t produce twenty-five emails. Certificates work differently — see the next question.

That’s the failure mode we designed around. A healthy 90-day Let’s Encrypt certificate spends its entire life “about to expire”, so counting down days on it is meaningless — and it gets worse, because the maximum certificate lifetime drops to 100 days in 2027 and 47 in 2029. So we don’t count days. We watch whether the renewal cycle is still turning: how much of the lifetime is left and whether the serial number changed. You hear from us when a renewal that should have happened didn’t.

ARI (RFC 9773) lets us ask the certificate authority directly which renewal window it recommends for your specific certificate. When that window passes and the serial number hasn’t changed, that isn’t our guess — it’s the issuer’s own answer. Almost no competing tool does this.

Most work fine — .cz publishes expiry dates and we read them. Some national registries don’t publish them at all. In that case we say so plainly instead of showing a confident wrong number: you enter the date once and get the full alert ladder anyway.

Because the number of domains tracks what your clients pay you, while the number of seats tracks nothing at all. Per-seat pricing also punishes you for adding a colleague to an account, which is a strange thing for a tool to do.

Nothing breaks and nothing extra gets charged. The domains you already watch keep being watched; adding new ones is blocked until you upgrade. There is no overage billing — a surprise invoice from a tool that sells peace of mind would destroy the exact thing it sells.

No. Five domains, forever, no card, no timer. It genuinely covers a solo developer’s own projects. We’d rather you use it for a year and upgrade when your portfolio grows than feel tricked in week three.

Yes, and you keep the service until the end of the period you paid for. After that the account drops to Free rather than being deleted — your first five domains keep being watched.

Never. Every check uses public DNS, registry and TLS data. No registrar login, no FTP password, no CMS account — we don’t want them. There is no credential to leak, which is also why we can watch a client’s domain without asking that client for anything.

No. Uptime tools tell you the patient has flatlined. Lapsewatch tells you about the appointment three months out. An expired domain takes down the website and the email at once, and by then the fix takes days, not minutes. Most of our users run both.

Fair question for a tool whose failure mode is silence. Every domain shows its last-checked timestamp, every run writes a heartbeat, and the dashboard shows a banner when checks fall behind. You should never have to wonder whether no news means good news.