For Webflow agencies
Domain and DNS monitoring for Webflow agencies
Webflow handles the certificate for a site's custom domain, as long as the domain keeps pointing at Webflow. So the risks for your clients are the domain renewal, the DNS records that someone else can edit, and the parts of the brand that don't live on Webflow.
01 — What goes wrong
Where things usually go wrong
- 01
Renewal depends on DNS staying put
Webflow's SSL hosting article says its certificates renew automatically "as long as the DNS records are continuously pointed to Webflow and the site loads on Webflow servers". Move a record and renewal stops.
- 02
CAA records added for something else
The same article says a domain with CAA records must explicitly allow Webflow's certificate providers, or certificates may fail to provision or renew. A new email or security service is a common reason CAA records appear.
- 03
The domain lives at the client's registrar
If the client bought the domain elsewhere, it renews there, on their card, with reminders going to their inbox.
- 04
Everything that isn't the marketing site
The app on a subdomain, the help center, the docs site, the old landing pages. Separate hosts, separate certificates, and nobody at Webflow is watching them.
02 — What helps
What matters most for you
- DNS change alerts
- We record NS, A, AAAA, MX and CAA records and alert when any of them change, so an edit made by someone else reaches you the same day.
- Domain expiry and registry statuses
- A daily RDAP lookup per domain: expiry date, registrar, nameservers and statuses such as transfer lock, pending delete and redemption.
- Certificate checks on every host
- Expiry, issuer, SANs, chain and hostname match every 6 hours, with alerts at 30, 14, 7, 3, 1 and 0 days.
- Subdomain discovery
- Certificate Transparency logs list the hostnames under the client's domain that have had certificates, including the ones that aren't on Webflow.
- Reports and status pages for clients
- White-label monthly PDF reports from Freelancer; white-label status pages on Agency ($29/month), on the client's own domain on Agency Pro.
03 — Practical notes
On Webflow, late renewal is normal
Webflow's SSL hosting article says its certificates are not set to renew in advance, and that monitoring tools may warn about that. Our renewal-overdue flag is one of those warnings. On a Webflow host, read it as a prompt to check DNS and CAA rather than as an emergency. The countdown alerts at 7, 3, 1 and 0 days still matter.
A handover checklist
When a site goes live, or when a client takes over the domain, run through this once and keep the answers in your notes.
- Check the apex and www with the SSL checker. Note the issuer and the expiry date.
- Look for CAA records. If there are any, make sure they allow the CAs that Webflow uses. Let's Encrypt explains how CAA works.
- Look up the domain in the domain expiry checker and write down the registrar and who holds the login.
- Run the subdomain certificate finder and list the hosts that aren't on Webflow. Decide who looks after each one.
The hosts that aren't on Webflow
Webflow sites often sit next to a product app, a help desk and a few campaign pages on other services. Those renew on their own schedules, and some of them don't renew themselves at all. Our guide on finding subdomains in Certificate Transparency logs shows how to build the list, and what happens when SSL expires covers what a visitor sees if one of them lapses.
ExpiryOwl watches the DNS, the domain and every certificate in one list per client. The first 5 domains are free.
Start with five domains, free.
The free plan watches 5 domains for one client: certificates, domain registration, DNS and uptime every 15 minutes. No card, no trial clock.