How incidents work
DomainDash automatically detects problems so nothing slips through.
What is an incident in DomainDash?
An incident is a record of something going wrong with one of your sites. When DomainDash detects a problem, like your site going down, an SSL certificate expiring, or DNS failing, it creates an incident automatically. When the problem goes away, the incident is resolved automatically too. There's nothing you need to do to open or close incidents; DomainDash handles the whole lifecycle for you.
If you've got an active SSL incident and want to know what's causing it, jump to the SSL troubleshooting section for specific causes and step-by-step fixes. (More check types coming soon.)
Pro and Business plans
The incidents feature is available on Pro and Business plans. All plans still receive email alerts when your sites go down — upgrading unlocks full timelines, team updates, and postmortems.
Detection
DomainDash doesn't raise the alarm after a single failed check. Networks are noisy, and a one-off timeout doesn't necessarily mean your site is down. Instead, we use a confirmation process to make sure a problem is real before we tell you about it.
Here's what happens:
- A check comes back with a problem (for example, your site returns an error or doesn't respond at all).
- DomainDash creates an incident in a confirming state and starts counting.
- We keep checking. Each time the same problem comes back, the confirmation count goes up.
- Once enough consecutive checks confirm the problem, the incident is opened and you get notified.
The number of confirmations required depends on the severity of the problem. Critical issues like a site going completely down need fewer confirmations (so you hear about them faster), while less urgent things like a certificate approaching expiry need a few more checks to rule out false positives.
If the problem goes away before enough confirmations are reached, the incident is quietly discarded. You never even see it. This keeps your notifications clean and trustworthy.
Severity
Not all problems are equally urgent. DomainDash assigns a severity level to each incident based on what's gone wrong. The scale runs from P0 (most critical) to P3 (least urgent):
| Severity | Label | What triggers it |
|---|---|---|
| P0 | Critical | Your site is completely down, or your domain name has expired |
| P1 | Needs fixing | Your SSL certificate has expired or is invalid, or DNS resolution is failing |
| P2 | Needs attention | Your site is running slowly, or your SSL certificate is expiring soon |
| P3 | Worth knowing | Your domain name is expiring soon |
Severity affects two things:
- How quickly you're notified. P0 incidents trigger an urgent email to your entire team within about a minute of being confirmed. Lower-severity incidents are grouped into a daily digest instead.
- How many confirmations are needed. Critical and high-severity problems (P0 and P1) need 2 confirmations. Medium-severity issues (P2) need 3. Advisory items (P3) are opened after a single check.
What types of incident can be raised?
DomainDash watches four aspects of your site and can raise incidents for each:
| Check type | Possible incidents |
|---|---|
| Uptime | Site is down, site is slow |
| SSL certificate | Certificate expired, certificate invalid, certificate expiring soon |
| DNS | Domain routing is failing |
| Domain registration | Domain expired, domain expiring soon |
Each incident type is tracked independently, so if your site goes down and your SSL certificate expires at the same time, you'll see two separate incidents, one for each problem.
Recovery and resolution
When the underlying problem goes away, DomainDash doesn't immediately declare the incident over. Instead, it confirms the recovery is genuine before closing the incident. This prevents false "all clear" notifications during unstable outages where a site flickers between up and down.
Here's what happens when checks start passing again:
- The incident enters a recovering state. DomainDash has detected that things look better, but wants to make sure.
- Additional checks are run to confirm the recovery. Each consecutive healthy check builds confidence that the problem is genuinely resolved.
- Once enough consecutive healthy checks pass, the incident is marked as resolved with a timestamp.
- For critical incidents (P0), a resolved notification is sent to your team so everyone knows the crisis is over.
If a check fails during recovery, the incident goes straight back to open. This means DomainDash won't tell you something is fixed until it's confident the fix is stable.
Incidents that were still in the confirming stage (not yet opened) are resolved silently. Since you were never notified about them, there's nothing to follow up on.
You can't manually close incidents
Incidents are tied to real monitoring data, so they're only resolved when DomainDash confirms the problem is gone. This keeps your incident history accurate and trustworthy. Every open incident genuinely represents an ongoing problem.
Frequently asked questions
What's the difference between P0, P1, P2, and P3 incidents?
Severity levels describe how urgent an incident is. P0 (Critical) means your site is completely down or your domain has expired. P1 (Needs fixing) means your SSL certificate has expired or DNS resolution is failing. P2 (Needs attention) means your site is slow or your SSL certificate is expiring soon. P3 (Worth knowing) means your domain is expiring soon. P0 triggers urgent alerts; P1–P3 are grouped into the daily digest.
How long does it take for an incident to be confirmed?
It depends on severity and your check frequency. P0 and P1 incidents need 2 consecutive failed checks before they're opened. P2 incidents need 3. P3 incidents open after a single check. With a 1-minute check frequency, a P0 outage is typically confirmed within 2–3 minutes of starting.
Can I manually close an incident?
No. Incidents are tied to real monitoring data, so they only resolve when DomainDash confirms the problem is gone through consecutive healthy checks. This keeps your incident history accurate — every open incident represents an ongoing problem, not a forgotten ticket.
What happens to incidents during recovery?
When checks start passing again, the incident enters a "recovering" state while DomainDash runs additional checks to confirm the recovery is genuine. If a check fails during recovery, the incident goes straight back to "open". This prevents false "all clear" notifications during unstable outages where the site flickers between up and down.
Will I be notified for every incident?
Only P0 (Critical) incidents trigger urgent alerts within about a minute of confirmation. P1, P2, and P3 incidents are grouped into a daily digest email so you're not interrupted for non-urgent issues. This keeps notifications meaningful and avoids alert fatigue.
Related
- Incident detail page to see the full timeline and post updates during an incident
- Notification channels to choose how you're alerted when something goes wrong
- Incident history to browse and filter all incidents across your sites
- Uptime monitoring for how DomainDash checks whether your site is online