For Shopify agencies
Domain and DNS monitoring for Shopify agencies
Shopify issues and renews the certificate for a store's connected domain, so the certificate itself is rarely the problem. The problems sit around it: the domain renewal at the client's registrar, a DNS record someone edited, and the blog or landing pages that don't live on Shopify at all.
01 — What goes wrong
Where things usually go wrong
- 01
Renewal still happens at the registrar
For a connected third-party domain, Shopify's help center says the provider remains the registrar and that settings, billing and renewals stay with that provider. Nothing in the Shopify admin renews it. If the client's card fails there, the store goes dark.
- 02
A DNS edit blocks the certificate
Shopify's domain troubleshooting page lists incorrect DNS records, CAA records that don't allow its certificate authorities (Let's Encrypt, Google and SSL.com) and DNSSEC among the reasons it can't provision an SSL certificate. One enthusiastic email setup wizard is enough.
- 03
The hosts that aren't on Shopify
The blog on WordPress, the landing page builder, the help desk subdomain, the tracking domain for email campaigns. Each has its own certificate and its own renewal, and none of it is Shopify's job.
- 04
No good week for an outage
A lapsed domain in the week before a sale is a very expensive way to learn who held the registrar login.
02 — What helps
What matters most for you
- Domain expiry and registry statuses
- A daily RDAP lookup per domain: expiry date, registrar, nameservers and statuses such as transfer lock, pending delete and redemption.
- DNS change alerts
- We record NS, A, AAAA, MX and CAA records and alert when any of them change, so an edit made by someone else reaches you the same day.
- Certificates on the satellite hosts
- Every certificate checked every 6 hours: expiry, issuer, SANs, chain and hostname match. That matters most on the hosts Shopify doesn't manage.
- Subdomain discovery
- Certificate Transparency logs show every hostname that has had a certificate under the brand's domain, so the forgotten campaign site shows up.
- Uptime with a keyword check
- HTTP checks that can look for a word on the page, so a storefront that loads but shows the wrong thing still counts as down. Every 3 minutes on Agency.
03 — Practical notes
What a connected domain should look like
Shopify documents the records it expects in its manual connection guide. Keep these in your client notes; when a DNS alert says a record changed, this is what you compare it with.
| Record | Shopify's documented value |
|---|---|
| A (apex) | 23.227.38.65 |
| AAAA (apex) | 2620:0127:f00f:5:: |
| CNAME (www) | shops.myshopify.com. |
| CAA (if the domain has any) | Must allow Let's Encrypt, Google and SSL.com |
If a client's domain has no CAA records at all, any public CA may issue for it, which is fine. The trouble starts when someone adds CAA records for another service and leaves Shopify's authorities out.
Find the hosts Shopify doesn't manage
Run the brand's domain through the subdomain certificate finder. Anything that isn't the store is yours to watch, or the client's to switch off. Then paste the live ones into the bulk SSL checker and look at the issuers and expiry dates. Our guide to finding subdomains in Certificate Transparency logs explains what the results mean.
Ask one question about every domain
Who holds the registrar login? If it is the client's founder, a former employee or "not sure", write it down and raise it now. The domain expiry checker shows the registrar, expiry date and statuses so you know where to look. Read the statuses as well as the date: a domain in redemption or pending delete is past its expiry already, and every day it stays there makes recovery harder.
ExpiryOwl checks domains daily and DNS for changes, and groups everything by client. Agency is $29/month for 250 domains, and the Free plan covers 5.
Start with five domains, free.
The free plan watches 5 domains for one client: certificates, domain registration, DNS and uptime every 15 minutes. No card, no trial clock.