# Domain checks

> Add the domains you run to Cloak Watch to check their certificate, issuer, expiry, CAA records and dangling CNAMEs once a day, with the lookups each check makes.

Source: https://docs.subcloak.com/cloak-watch/domains/

Added in Cloak Watch 1.2.0.

**Domains**, under **Beyond this Mac** in the sidebar, checks the domains you run: whether the certificate is valid and trusted, who issued it and when it expires, whether CAA records allow that issuer, and whether a CNAME points at something that's gone and could be claimed by someone else. Watch checks only domains you add, once a day and when you click **Check Now**.

*[Screenshot: The Domains screen: Your domains with shop.example.com, status.example.com pointing at a name that no longer exists, blog.example.com expiring in 9 days and docs.example.com, an Add Domain button, and Found on this Mac with shopapp-api.fly.dev and an Add button. Domains on a test Mac, with a dangling CNAME and a certificate about to expire.]*

## Add a domain

1. Open **Domains** and click **Add Domain…**.

2. In **Add a Domain**, type the domain, tick **I own or run this domain**, and click **Add and Check**.

**Found on this Mac** suggests domains from your projects' Cloudflare, Fly.io and GitHub Pages settings (see [Footprint](https://docs.subcloak.com/cloak-watch/footprint/)). Nothing is looked up until you add one.

Each domain's row shows its issuer, when the certificate expires and whether CAA is set. Its **…** menu has **Check Now**, **Open in Browser** and **Remove**.

## What Watch checks

| Card | Tier | What |
|---|---|---|
| [DOM-1](https://docs.subcloak.com/cloak-watch/detections/#dom-1) | Review; FYI | The certificate has expired or expires within 14 days (Review), or within 30 days (FYI) |
| [DOM-2](https://docs.subcloak.com/cloak-watch/detections/#dom-2) | Review | The certificate chain uses a certificate authority a headline distrusts, from the same lists as [trust-store checks](https://docs.subcloak.com/cloak-watch/check-my-mac/#trust-stores) |
| [DOM-3](https://docs.subcloak.com/cloak-watch/detections/#dom-3) | Review | macOS doesn't trust the certificate for the domain |
| [DOM-4](https://docs.subcloak.com/cloak-watch/detections/#dom-4) | Review | A CNAME points at a name that no longer exists, so someone could claim it (subdomain takeover) |
| [DOM-5](https://docs.subcloak.com/cloak-watch/detections/#dom-5) | FYI | No CAA record: any certificate authority may issue for the domain |
| [DOM-6](https://docs.subcloak.com/cloak-watch/detections/#dom-6) | FYI | CAA records don't allow the certificate authority that issued the current certificate |

If DNS doesn't answer, Watch says so rather than calling a CNAME dangling.

## What a check sends

Checking a domain makes network lookups from this Mac. Nothing goes to Subcloak, and Watch never looks up a domain you haven't added.

- **DNS queries** through your usual resolver: for the domain, the names its CNAME records point to, and its parent domains for CAA records (`www.shop.example.com`, then `shop.example.com`, then `example.com`).
- **A TLS connection** to the domain on port 443, when it resolves, to read its certificate. Watch asks for it to bypass any proxy, and sends nothing after the handshake.

> **Behind a TLS-inspecting proxy:**
> If a local TLS-inspecting proxy, such as Cloak Proxy or a company proxy, answers for the domain, Watch says "A local TLS proxy answered, so the certificate wasn't checked" and doesn't judge the certificate it saw. DNS checks still run.

## From Terminal

`watchctl domain shop.example.com` runs the same checks and prints the CNAME chain, the certificate chain, whether macOS trusts it and the CAA records. See [watchctl domain](https://docs.subcloak.com/cloak-watch/watchctl/#domain).

## Related

  - [Footprint](https://docs.subcloak.com/cloak-watch/footprint/): Domains your projects name.
  - [Detection catalogue](https://docs.subcloak.com/cloak-watch/detections/#domains-dom): DOM-1 to DOM-6.
  - [What leaves your Mac](https://docs.subcloak.com/cloak-watch/settings/#what-leaves-your-mac): The Domain checks row.