Beyond this Mac
Domain checks
New in 1.2.0 Requires Cloak Watch 1.2.0 or later.
Add the domains you run to Cloak Watch to check their certificate, issuer, expiry, CAA records and dangling CNAMEs once a day, with the lookups each check makes.
Domains, under Beyond this Mac in the sidebar, checks the domains you run: whether the certificate is valid and trusted, who issued it and when it expires, whether CAA records allow that issuer, and whether a CNAME points at something that’s gone and could be claimed by someone else. Watch checks only domains you add, once a day and when you click Check Now.
Domains on a test Mac, with a dangling CNAME and a certificate about to expire.
Add a domain
Section titled “Add a domain”-
Open Domains and click Add Domain….
-
In Add a Domain, type the domain, tick I own or run this domain, and click Add and Check.
Found on this Mac suggests domains from your projects’ Cloudflare, Fly.io and GitHub Pages settings (see Footprint). Nothing is looked up until you add one.
Each domain’s row shows its issuer, when the certificate expires and whether CAA is set. Its … menu has Check Now, Open in Browser and Remove.
What Watch checks
Section titled “What Watch checks”| Card | Tier | What |
|---|---|---|
| DOM-1 | Review; FYI | The certificate has expired or expires within 14 days (Review), or within 30 days (FYI) |
| DOM-2 | Review | The certificate chain uses a certificate authority a headline distrusts, from the same lists as trust-store checks |
| DOM-3 | Review | macOS doesn’t trust the certificate for the domain |
| DOM-4 | Review | A CNAME points at a name that no longer exists, so someone could claim it (subdomain takeover) |
| DOM-5 | FYI | No CAA record: any certificate authority may issue for the domain |
| DOM-6 | FYI | CAA records don’t allow the certificate authority that issued the current certificate |
If DNS doesn’t answer, Watch says so rather than calling a CNAME dangling.
What a check sends
Section titled “What a check sends”Checking a domain makes network lookups from this Mac. Nothing goes to Subcloak, and Watch never looks up a domain you haven’t added.
- DNS queries through your usual resolver: for the domain, the names its CNAME records point to, and its parent domains for CAA records (
www.shop.example.com, thenshop.example.com, thenexample.com). - A TLS connection to the domain on port 443, when it resolves, to read its certificate. Watch asks for it to bypass any proxy, and sends nothing after the handshake.
From Terminal
Section titled “From Terminal”watchctl domain shop.example.com runs the same checks and prints the CNAME chain, the certificate chain, whether macOS trusts it and the CAA records. See watchctl domain.