CRITICAL: Port and TLS checks for apex domains silently do nothing #19

New Issue

2026-02-20T13:49:42+01:00

clawbot commented

2026-02-20 13:49:42 +01:00

Bug

checkAllPorts() and runTLSChecks() both iterate over w.config.Domains and call collectIPs(domain). However, collectIPs reads from GetHostnameState(hostname), which only returns state set by checkHostname(). Domains go through checkDomain() which sets DomainState (nameservers only), never HostnameState.

func (w *Watcher) checkAllPorts(ctx context.Context) {
    // ...
    for _, domain := range w.config.Domains {
        w.checkPortsForHostname(ctx, domain)  // calls collectIPs
    }
}

func (w *Watcher) collectIPs(hostname string) []string {
    hs, ok := w.state.GetHostnameState(hostname)  // always false for domains!
    if !ok {
        return nil  // silently returns nothing
    }
    // ...
}

Impact

If a user configures example.com as a target (an apex domain), DNS NS monitoring works, but port monitoring and TLS certificate monitoring are silently skipped. No error is logged.

Fix

Either:

Resolve A/AAAA records for domains too (treating them also as hostnames for IP-level checks), or
Remove domains from the port/TLS check loops if they are intentionally NS-only, and document this behavior, or
Unify the domain/hostname distinction so all targets get full monitoring.

## Bug `checkAllPorts()` and `runTLSChecks()` both iterate over `w.config.Domains` and call `collectIPs(domain)`. However, `collectIPs` reads from `GetHostnameState(hostname)`, which only returns state set by `checkHostname()`. Domains go through `checkDomain()` which sets `DomainState` (nameservers only), never `HostnameState`. ```go func (w *Watcher) checkAllPorts(ctx context.Context) { // ... for _, domain := range w.config.Domains { w.checkPortsForHostname(ctx, domain) // calls collectIPs } } func (w *Watcher) collectIPs(hostname string) []string { hs, ok := w.state.GetHostnameState(hostname) // always false for domains! if !ok { return nil // silently returns nothing } // ... } ``` ## Impact If a user configures `example.com` as a target (an apex domain), DNS NS monitoring works, but port monitoring and TLS certificate monitoring are silently skipped. No error is logged. ## Fix Either: 1. Resolve A/AAAA records for domains too (treating them also as hostnames for IP-level checks), or 2. Remove domains from the port/TLS check loops if they are intentionally NS-only, and document this behavior, or 3. Unify the domain/hostname distinction so all targets get full monitoring.

clawbot referenced this issue from a commit

2026-02-21 09:53:44 +01:00

fix: look up A/AAAA records for apex domains to enable port/TLS checks (closes #19)

clawbot referenced a pull request that will close this issue

2026-02-21 09:56:04 +01:00

fix: look up A/AAAA records for apex domains to enable port/TLS checks (closes #19) #21

sneak closed this issue

2026-02-28 12:09:04 +01:00

sneak referenced this issue from a commit

2026-02-28 12:09:06 +01:00

Merge pull request 'fix: look up A/AAAA records for apex domains to enable port/TLS checks (closes #19)' (#21) from fix/domain-port-tls-state-lookup into main

Sign in to join this conversation.