Skip to main content
Version: 0.8

Domain Checker

The Domain Checker discovers publicly known subdomains for a root domain using passive discovery: it queries public data sources (certificate transparency logs, DNS datasets) via the open-source subfinder tool, without ever probing your servers. You then review the results and bulk-import selected hostnames as SSL certificate tokens, optionally creating endpoint monitors at the same time.

It does not scan private DNS or internal network records. Only publicly known subdomains are discovered. To track internal or private endpoints directly, add them individually via Endpoint & SSL monitoring instead, which self-hosted TokenTimer can reach from your own network.

Availability​

Self-hosted TokenTimer has no plan tiers, so the Domain Checker is available to every workspace with no discovery or import caps beyond what your infrastructure can handle.

How it works​

  1. Open Endpoint & SSL monitor on the dashboard and switch to the Domain Checker.
  2. Enter a root domain (for example example.com) and run a lookup. TokenTimer queries subfinder's passive discovery sources and returns the publicly known subdomains it found. If only some discovery sources respond, the result is marked partial.
  3. Review the results and select the hostnames you want to track.
  4. Import the selection. Each hostname's live SSL certificate is fetched and imported as an ssl_cert token. Hostnames are skipped when they are duplicates, do not resolve in DNS, or fail validation; the import summary shows counts per skip reason.
  5. Optionally enable create monitors during the import to also create endpoint monitors for the imported hostnames, with a check interval, health checking, an "alert after failures" value, and a contact group.

Rate limits​

Lookups are rate limited per workspace and per user to keep discovery sources healthy. If you hit the limit, wait and retry.

Audit trail​

Lookups and imports are recorded as DOMAIN_CHECKER_LOOKUP and DOMAIN_CHECKER_IMPORT audit events, including result counts and skip reasons. See Domain Checker events.