Domain and certificate checker

What this checks

This tool looks at your domain name and at the certificate that puts the padlock in the address bar, then reports what it finds in plain words.

For the certificate it connects to your site the way a browser does. It checks that the certificate is valid today, how many days are left before it needs renewing, whether it matches the address people actually type, and whether the chain of trust is complete. A certificate that works in your browser can still fail on an older phone when part of that chain is missing, so it is worth knowing about.

For the domain it asks the registry who manages the name, when it was registered, and when it expires. It reports the transfer lock, which is the setting that stops someone moving your domain to another company without your say so, and whether DNSSEC is switched on.

It also checks the quiet things that break sites: whether your address and the www version both resolve, whether visitors who type the plain http address are sent to the secure version, and whether you have CAA records saying who may issue a certificate for you.

Nothing is changed and no mail is sent. The tool only reads what is already public.

Questions people ask

Who owns a domain name?

Nobody owns a domain outright. You hold the right to use it for a set period through a registrar, and that right lapses if a renewal is missed.

What happens when a domain expires?

The website and any email on that domain stop working. Registries usually hold the name for a grace period, and recovering it after that can be slow and expensive.

What is a transfer lock?

It is a setting at the registry that stops your domain being moved to another company until you deliberately unlock it. Leaving it on is the easiest thing you can do to protect a domain.

What is DNSSEC?

DNSSEC signs the answers your domain gives out, so someone cannot quietly substitute their own. It is not essential for a small site, and it is the last box to tick for a domain that is fully looked after.