See all checks →
Domain & DNS

Certificate transparency and subdomain takeover monitoring.

Relvato watches the public certificate logs for certificates issued in your domain's name by an authority you don't use, looks for subdomains that point at services you no longer have, and checks your CAA records will let your next certificate renew.

All clear: CAA allows your renewals, no surprise certificates.
Supported sitesNo plugin needed
WordPresssupportedAI-built appssupportedAny websitesupported
Add your URL and this check runs from the outside, the way a visitor sees your site.
What it checks
  • ✓No recent certificate from an unfamiliar authority
  • ✓No subdomain points at a resource that no longer exists
  • ✓CAA allows your certificate authority to renew
Why it matters

Every certificate issued anywhere is published in Certificate Transparency logs — so a certificate you didn't ask for is often the first sign that someone controls one of your subdomains or your DNS. The usual way in is a forgotten record: shop-old pointing at a Heroku app or an S3 bucket you deleted, which anyone can now claim and serve pages from under your name.

How it works
  • Reads the Certificate Transparency logs (via crt.sh) and flags recent certificates from an authority your domain hasn't used before — renewals from your usual authorities, including the several a CDN rotates between, stay quiet.
  • Takes the subdomains from those logs, follows each one's CNAME and flags any that point at something that no longer exists, or at a known service's “nothing here” page.
  • Compares your CAA records with the authority that issued your current certificate, so a CAA change that would block the next renewal is caught before renewal day.
Questions, answered
Where does it find my subdomains?

From the Certificate Transparency logs — every subdomain that ever had a public certificate is listed there — plus your site's own address.

What if the certificate logs are down?

crt.sh, the public log search, is often slow or unavailable. The check then says so and still checks CAA and your site's own address, instead of failing.

Does it probe my subdomains?

It resolves their DNS and, only for known takeover-prone services, loads the home page once to recognise the service's “nothing here” page. Nothing attack-like is sent.

Related checks
Certificates & subdomains

Put this check on autopilot.

Free forever on one site — every check, 100 runs a month. No card, no sales call.