How incidents work

DomainDash confirms a problem is real before it tells you about it.

What is an incident in DomainDash?

An incident is a record of something going wrong with one of your sites. When DomainDash spots a problem (your site going Down, an SSL certificate expiring, or DNS failing) it opens an incident for you. When the problem clears, DomainDash resolves the incident too. You don't open or close anything by hand.

If you've got an active SSL incident and want to know what's causing it, jump to the SSL troubleshooting section for specific causes and step-by-step fixes. Troubleshooting guides for uptime, DNS, and domain registration live under the Troubleshooting section too.

Detection runs on every plan; the incidents experience is a feature

DomainDash detects problems and emails your team when a site goes Down on every plan, including the Free plan. The full incidents experience (timelines, team updates, live check status, and post-mortems) is part of the Incidents feature.

Plan availability

Incidents is available on Pro and Business. See the plan comparison.

Detection

DomainDash doesn't alert you after a single failed check. Networks are noisy, and a one-off timeout can clear on the next check. A problem has to show up on consecutive checks before DomainDash opens an incident and notifies you:

1. A check comes back with a problem (for example, your site returns an error or doesn't respond at all). If it's an uptime check, the site shows Down straight away.
2. DomainDash creates an incident in a confirming state. You can see it in your incidents list under the Confirming filter, where the row shows the domain with a Confirming badge. The incident's own page is titled "Checking on" followed by the site. Nothing is sent until the incident is confirmed.
3. DomainDash keeps checking. Each time the same problem comes back, the confirmation count goes up.
4. Once enough checks in a row confirm the problem, DomainDash opens the incident.

How many checks it takes depends on the kind of problem, whatever its severity:

• 2 checks for a Down site, a failed content check, an invalid certificate, or failing DNS.
• 12 checks for a site responding slowly, so a brief wobble doesn't open an incident.
• 1 check for anything expiring or expired, because the date is certain and there's nothing to rule out.

Confirmation counts check results, not minutes. Two failed checks in a row confirm a Down incident, and the alert goes out about a minute after that. How long that takes depends on your plan: Pro, Business, and the trial check from both locations at once, so two failures can arrive in the same round, Starter checks every minute, and the Free plan checks every 5 minutes. The alert usually arrives within a couple of minutes on a paid plan, and around six minutes on the Free plan.

If the next check passes while an incident is still confirming, DomainDash removes it and sends nothing.

While a Down or content-check incident is being confirmed, is open, or is recovering, DomainDash checks the site from all of its own locations at once. A site with one location also borrows the nearest other one. These checks start within about 15 minutes.

Severity

DomainDash gives each incident a severity level based on what's gone wrong. The scale runs from P0 (most urgent) to P3 (least urgent):

Severity	Label	What triggers it
P0	Urgent	Your site is Down, or a page failed its content check
P1	Needs fixing	Your SSL certificate or domain name has expired, your SSL certificate is invalid, or DNS resolution is failing
P2	Needs a look	Your site is responding slowly
P3	Worth knowing	Your SSL certificate or domain name is expiring soon (this rises to P2 in the final day before the deadline)

An "expiring" incident opens at 7 days (Worth knowing) and is raised to Needs a look at 1 day. When the date passes, a separate "expired" incident opens at Needs fixing.

In the app, severity appears as the bare code (P0, P1, P2, P3) alongside the problem. The friendly labels above are how we talk about each level.

Severity decides how you're notified:

• Urgent incidents alert you immediately. DomainDash emails every member of your team who hasn't opted out of incident alerts, usually within a couple of minutes on a paid plan, and around six minutes on the Free plan. On plans that include them, it also sends an SMS and a Slack message.
• Needs fixing, Needs a look, and Worth knowing incidents wait. They appear in the app and in the daily digest.

Webhooks are separate: DomainDash sends webhook events as soon as an incident opens, whatever its severity.

See Notification channels for what each notification contains.

What types of incident can be raised?

DomainDash checks four aspects of your site and can raise incidents for each:

Check type	Possible incidents
Uptime	Site is Down, site responding slowly, page failed its content check
SSL certificate	Certificate expired, certificate problem, certificate expiring soon
DNS	Domain routing is failing
Domain registration	Domain expired, domain expiring soon

A content check fails when a page loads but doesn't contain the text, element, or JSON response you asked us to look for. DomainDash tracks each incident type independently, so if your site goes Down and your SSL certificate expires at the same time, you'll see two separate incidents.

Recovery and resolution

DomainDash confirms a recovery the same way it confirms a problem. An incident needs as many passing checks in a row as it took to confirm it:

1. After the first passing check on a Down or failed-content-check incident, the site page header reads Recovering.
2. DomainDash keeps checking. If a check fails during recovery, the incident goes back to open.
3. Once enough checks in a row pass, DomainDash marks the incident resolved with a timestamp, and the header reads Healthy. If uptime for the selected timeframe (24 hours by default) is under 97%, it reads Unstable until the figure recovers.
4. For P0 (Urgent) incidents, DomainDash sends your team a resolved notification.

For an invalid-certificate or failing-DNS incident, the header follows the uptime check, so it can read Healthy while that incident is still recovering in the incidents list. The recovering stage applies only to incidents that take more than one check to confirm. An expiry incident (a certificate or domain expiring or expired) closes on the first passing check.

A site that was responding slowly follows a shorter path in the header. If no incident has opened, the site reads Healthy as soon as a check comes back under 1000ms. If an incident for a site responding slowly is open, the first passing check shows Recovering and the next shows Healthy, while the incident itself closes after 12 passing checks.

You can't manually close incidents

DomainDash resolves an incident only when checks confirm the problem is gone, so every open incident in your history is a problem that is still happening.

Frequently asked questions

What's the difference between P0, P1, P2, and P3 incidents?

Severity describes how urgent an incident is. P0 (Urgent) means your site is Down, or a page failed its content check. P1 (Needs fixing) means your SSL certificate or domain name has expired, your SSL certificate is invalid, or DNS resolution is failing. P2 (Needs a look) means your site is responding slowly. P3 (Worth knowing) means your SSL certificate or domain name is expiring soon. P0 incidents alert you immediately; P1 to P3 appear in the app and in the daily digest.

How long does it take for an incident to be confirmed?

It depends on the kind of problem and your check frequency. A Down site, a failed content check, an invalid SSL certificate, or failing DNS takes 2 checks in a row. A site responding slowly takes 12. Anything expiring or expired opens on the first check. Confirmation counts check results, so the time depends on your plan: a Down alert usually arrives within a couple of minutes on a paid plan, and around six minutes on the Free plan.

Can I manually close an incident?

No. DomainDash resolves an incident only when checks confirm the problem is gone, so every open incident is a problem that is still happening.

What happens to incidents during recovery?

For a Down or failed-content-check incident, the site page header reads Recovering after the first passing check. For an invalid-certificate or failing-DNS incident the header follows the uptime check, so it can read Healthy while that incident is still recovering in the incidents list. An incident resolves once it has had as many passing checks in a row as it took to confirm the problem, and a failed check during recovery puts it back to open. An expiry incident closes on the first passing check, with no Recovering stage.

Will I be notified for every incident?

No. Only P0 (Urgent) incidents send an immediate alert, by email and, on plans that include them, SMS and Slack. It usually arrives within a couple of minutes on a paid plan, and around six minutes on the Free plan. P1, P2, and P3 incidents appear in the app and in the daily digest.

Related

• Incident detail page to see the full timeline and post updates during an incident
• Notification channels to choose how you're alerted when something goes wrong
• Incident history to browse and filter all incidents across your sites
• Uptime checks for how DomainDash checks whether your site is online