Documentation sections

Domain check: DNS, HTTPS and statuses

What the tracker checks for a domain, what each status in the Status column means and how to fix an error at each stage.

The tracker checks every domain in the Domains («Домены») section in four stages: DNS, HTTP, HTTPS, Certificate («Сертификат»). The outcome is shown in the Status («Статус») column, and the details are in the check window. Everyone who has access to the domain can see the status; owners, admins and team leads can run the check.

Running a check

For a new domain, the first check starts on its own after the domain is added. Automatic checks run one domain at a time, so if you add many domains at once, the results appear one after another. After that, the tracker repeats the check on a schedule.

To check a domain right now:

  1. Open Domains.
  2. Click ⟳ in the domain row. On a phone, the button is called ⟳ Check («⟳ Проверить»).
  3. Wait for the result in the window that opens. While the check is running, the top of the window says “Checking the domain…” («Проверяем домен…») and the button is called Checking… («Проверка…»).

The window also opens when you click the domain status. The window title is the domain name, with the caption “domain readiness” («готовность домена») above it. The window shows:

  • the overall status and the result of each stage;
  • “Certificate valid until” («Сертификат действует до») — the certificate expiry date, if the check obtained it;
  • “Addresses” («Адреса») — the domain's IP addresses from DNS;
  • “Checked” («Проверено») and “Next check” («Следующая проверка») — the time of the last and the next check;
  • the Check («Проверить») button, shown to owners, admins and team leads.

The domain list refreshes on its own every 30 seconds.

Check stages

StageWhat is checked
DNSThe domain has addresses in DNS, and all of them are public. The addresses are shown in the “Addresses” line
HTTPThis tracker installation responds on the domain over http://. A redirect to https:// of the same domain also counts
HTTPSThis tracker installation responds on the domain over https://
CertificateThe certificate is valid, issued for this domain, and its chain is trusted

If the DNS stage ends with an error, the other stages are not run and show “Not checked yet” («Пока не проверено»). The HTTP and HTTPS stages are checked independently of each other.

A domain is ready when all four stages succeed. For a domain with the Domain on Cloudflare («Домен на Cloudflare») checkbox, the DNS stage succeeds only if all of the domain's addresses belong to Cloudflare — see Working with Cloudflare.

The stage result text is colored: green — the stage passed, orange — a warning, red — an error, gray — “Not checked yet”.

Statuses in the “Status” column

StatusWhat it meansWhat to do
Ready («Готов»)All stages succeeded, and the certificate expires in 7 days or moreNothing
TLS expires soon («Скоро истекает TLS»)All stages succeeded, but the certificate expires in less than 7 daysOpen the window and look at the date in the “Certificate valid until” line
Needs attention («Требует внимания»)At least one stage did not passOpen the window, find the stage with an error or warning and compare its text with the message table
Certificate expired («Сертификат истёк»)The certificate has expiredOpen the window and compare the Certificate line with the message table
Check outdated («Проверка устарела»)The time of the next check passed more than a minute ago, and there is no new resultClick Check. If many domains have this status, look at the Domain check («Проверка доменов») task on the System status page
Not checked («Не проверен»)There is no check result yetFor a new domain, wait for the first check. If the status does not change, click Check: after that, the status is updated on schedule

If several statuses apply at once, one is shown, in this order: “Not checked”, “Check outdated”, “Certificate expired”, “Needs attention”, “TLS expires soon”, “Ready”.

A status may have the “in registry” («в реестре») mark next to it; it relates to the blocklist registry, not to the readiness check.

Repeat checks and the limit

The time of the next check is shown in the window in the “Next check” line.

ResultNext check
The domain is readyIn 1 hour
1st failure in a rowIn 1 minute
2nd failure in a rowIn 5 minutes
3rd failure in a rowIn 15 minutes
4th–6th failure in a rowIn 1 hour
7th and laterIn 6 hours

A failure is any check after which the domain is not ready, including one run manually. After a successful check, the failure counter is reset.

The whole team can run no more than 20 manual checks per minute. If you exceed this, the panel shows “Too many checks. Retry in a minute.” («Слишком много проверок. Повторите через минуту.»)

When a domain is routed through a reverse proxy node or moved to another node, including automatically when a node fails, the previous result is reset. Until the next check the status is “Not checked”, and the check itself starts without clicking the button.

Certificate issuance

The tracker server issues the HTTPS certificate on its own the first time the domain is accessed over HTTPS. A certificate is issued only for domains added to the Domains section. There is no separate issue button.

For issuance, the domain's A record must point to the IP of the tracker server, and incoming ports 80 and 443 must be open — see Ports and network. For domains behind Cloudflare, see SSL mode in Cloudflare.

The first check of a new domain also accesses it over HTTPS. If it ended with an error at the HTTPS and Certificate stages, wait for the repeat check in a minute or click Check.

Stage messages

DNS

MessageCause and action
“Public addresses received” («Публичные адреса получены»)The stage passed
“DNS returned no address: check the A/AAAA records” («DNS не вернул адрес: проверьте A/AAAA-записи»)The domain has no A or AAAA record, or the record has not updated yet. Check the record with your DNS provider and repeat the check later
“A domain without a scheme, port or path is required” («Нужен домен без схемы, порта и пути»)The name is not written as a domain: with https://, a port or a path, without a dot, as an IP address, or with characters other than Latin letters, digits, dots and hyphens. An internationalized name is written in punycode. The name cannot be edited: delete the domain and add it again, for example go.example.com
“Checking an internal or service address is forbidden” («Проверка внутреннего или служебного адреса запрещена»)At least one of the domain's addresses in DNS is internal or a service address. Keep only public IPs in the records
“Not all addresses are proxied by Cloudflare” («Не все адреса проксированы Cloudflare»)A warning for a domain with the Domain on Cloudflare checkbox: not all of the domain's addresses belong to Cloudflare. The other stages are checked, but the domain is not considered ready. Turn on proxying (the orange cloud) for all of the domain's records

HTTP and HTTPS

MessageCause and action
“This tracker installation responds” («Отвечает эта установка трекера»)The stage passed
“Redirect to HTTPS of this domain” («Перенаправление на HTTPS этого домена»)The HTTP stage passed: the request was redirected to https:// of the same domain
“No response: network, timeout or forbidden address” («Нет ответа: сеть, таймаут или запрещённый адрес»)The connection was not established or the response did not arrive in time. Check where the DNS record points and incoming ports 80 and 443. At the HTTPS stage, the same message appears on a certificate error — the cause is shown in the Certificate line
“HTTP 404: response from our tracker not confirmed” («HTTP 404: ответ нашего трекера не подтверждён»)A response was received, but not from this tracker installation. Instead of 404, the message shows the actual response code. Check that the domain points to the server of this tracker, not to another site or hosting
“HTTP redirects to a different address” («HTTP перенаправляет на другой адрес»)The HTTP stage: the response is a redirect, but not to https:// of the same domain. Check where the domain's DNS record points
“Could not prepare the check” («Не удалось подготовить проверку»), “Invalid address” («Неверный адрес»)The stage request was not sent. Repeat the check

Certificate

MessageCause and action
“Certificate is valid, name and chain verified” («Сертификат действителен, имя и цепочка проверены»)The stage passed
“TLS unavailable: connection or handshake not completed” («TLS недоступен: соединение или рукопожатие не завершено»)A secure connection was not established. Check where the DNS record points and incoming port 443, then repeat the check
“Certificate expired or not yet valid” («Сертификат истёк или ещё не действует»)The current date is outside the certificate validity period. The expiry date is in the “Certificate valid until” line
“Certificate issued for a different domain” («Сертификат выдан для другого домена»)A server with a certificate for a different name responds at the domain address. Check where the DNS record points
“Certificate chain not confirmed by a trusted authority” («Цепочка сертификата не подтверждена доверенным центром»)The certificate is self-signed or issued by an authority the tracker server does not trust. Check where the DNS record points
“Certificate is invalid” («Сертификат недействителен»)The certificate failed the check for another reason
“Certificate check not confirmed” («Проверка сертификата не подтверждена»)An HTTPS response was received, but the certificate chain was not confirmed. Repeat the check

Errors when starting a check

The message appears in the window above the stages, in red.

MessageCause and action
“Too many checks. Retry in a minute.”The limit of 20 manual checks per minute was exceeded
“The domain is already being checked. Refresh the list in a few seconds.” («Домен уже проверяется. Обновите список через несколько секунд.»)A check of this domain is already running, manually or on schedule. The result will appear in the list
“Check already in progress” («Проверка уже выполняется»)Same as above

What the check does not confirm

The window has a note: “The check does not create clicks. Readiness is confirmed by a response from this tracker installation; DNS alone does not guarantee it.” («Проверка не создаёт клики. Готовность подтверждается ответом этой установки трекера; DNS сам по себе её не гарантирует.»)

  • The “Ready” status means that this tracker installation serves the domain and the certificate passed the check.
  • The check does not open campaigns, landing pages or offers, so it does not confirm that a specific link works.
  • Check requests come from the tracker server. The check does not show whether the domain is reachable from the visitor's country.
  • Whether the domain is in the blocklist registry is checked separately.
  • The result reflects the moment of the check. The time is shown in the “Checked” line.
Updated Need help? ↗