Skip to main content
A zone is only as alive as the domain registration behind it. When example.com lapses at the registrar, every zone DNZ serves for it stops resolving on the internet, however healthy DNZ is. DNZ can watch the registration for you: once a day it asks the registry over RDAP (the JSON successor of WHOIS) when the domain expires, who the registrar is and which statuses it carries, and alerts before it is too late.
Off by default, turned on per zone. While no zone has it on, DNZ does nothing at all: no downloads, no requests.

Turn it on

On the zone’s page, Domain expiry → switch on. Or from the terminal:
Turning it on looks the domain up at once; after that DNZ checks once a day. The card on the zone’s page shows the expiry date, the registrar, the registry statuses, the last and next check, and a Check now button. When the domain needs attention (within a threshold, expired, on hold, lookups failing) the zone’s header carries a badge.

Which domain is looked up

The registered domain the zone belongs to: the zone itself for example.com, or the domain it sits in for lab.example.com or shop.example.co.uk (that is example.co.uk). DNZ finds it with the ICANN part of the public suffix list. When that gets it wrong for your case, set it by hand (the zone or a domain the zone sits in):

How DNZ asks

  • The RDAP server for the top-level domain comes from IANA’s bootstrap file (https://data.iana.org/rdap/dns.json). Both it and the public suffix list are kept in the data folder and fetched again once a week, only while a check runs.
  • One request per monitored zone per day, at least 10 seconds apart per RDAP server.
  • A failed lookup is tried again after 1 hour, then 2, 4, 8, 16 and at most 24 hours.
  • A top-level domain without RDAP (some country domains) is asked over WHOIS (TCP port 43), using the server IANA’s whois.iana.org names. One with neither (such as .internal) shows as unknown. Some registries publish no expiry date (.de, for one); DNZ then still watches the statuses.
  • Every lookup also keeps the registry’s whole answer as the zone’s domain info.
  • In a cluster only the leader checks.

Alerts

Add the event domain_expiry to a notification provider (Telegram, Resend, SMTP or a webhook). DNZ alerts when: Each threshold alerts once per expiry date: a zone turned on with 5 days left alerts once, for the 7-day threshold. When the expiry date moves later (renewed), the thresholds count again.

Diagnostics and metrics

Each monitored zone is a Diagnostics finding (domain_expiry:<zone>): a failure when the domain expired, is on hold or being deleted, a warning within the largest threshold or when lookups keep failing, each with how to fix it. They show on Settings → Diagnostics and in dnz doctor. With metrics on, dnz_domain_expiry_days{zone,domain} gives the days left (negative once expired), with dnz_domain_expiry_timestamp_seconds and dnz_domain_expiry_lookup_failures. The alert rules include DnzDomainExpiring (under 14 days) and DnzDomainExpired.

CLI

API

state is off, pending, ok, expiring, expired, hold, failing or unknown.