Changelog
Everything that shipped, dated. Only what is already live — nothing here is a plan.
- feature
The Monitor is now on the API
Watched domains, the host inventory and the service checks can be driven by an API key, not only from the panel: add a portfolio, publish the TXT, verify ownership, discover hosts and switch service profiles on or off — all over HTTP. Two new scopes, monitor:read and monitor:write, documented at /docs/reference/monitor and /docs/reference/hosts. They are deliberately NOT granted by default: a key created without an explicit scope list still gets only the four DNS scopes, and existing keys gain nothing — a scope arriving by omission would quietly widen every automation already out there. Issue a new key with the scopes you want. The audit log now names which key acted.
- feature
Is the service up? Webmail, API and e-mail, per host
The "is it up?" check asked one question about one name: the apex. Now every host in your certificate inventory takes service profiles: Website or API (HTTPS), Webmail (login page + IMAP) and Incoming e-mail (SMTP, read by the banner, not just an open port). You tick a box — there is no port, path or expected status to fill in, no agent to install, and we never sign in to your services. "Discover hosts" already ticks the right profile for you. A failure is confirmed before it becomes an alert, and we only alert after seeing the service up at least once; when we cannot reach port 25 from here, we say "not measured" instead of blaming your server. Each profile can be published on your status page. 2 service checks per domain on Free, 15 on Growth, 50 on Scale.
- feature
Status page: a public page for your own customers
Every organization can publish a status page at /s/your-name with the state of what we already watch: checks of a watched domain, certificate hosts, health checks, or manual components. The badge follows the checks; incidents are written by you, with a dated timeline. 90 days of history and uptime per component are derived from the alerts already recorded, so nothing is measured twice. Free plan: 1 page with 3 components; Growth: 3 pages with 15; Scale: no limit. Custom domains and e-mail subscribers are not in this version.
- feature
Certificates per host: api., mail. and panel. now count
The TLS check looked only at the domain apex. Each watched domain now has a certificate inventory: hosts discovered from your zone here and from CT logs (or added by hand), each checked at most every 6 hours, with issuer, key algorithm, names and expiry. Alerts at 30 days (escalating at 7), on an invalid chain and when the certificate changes issuer or names. A renewal with the same issuer and names is not treated as a change. 5 hosts per domain on Free, 100 on Scale.
- infrastructure
Webhook signature header is now X-Quathos-Signature
Alert webhooks were carrying the signature in two headers during the rebrand — X-Quathos-Signature and the former X-Qflaryx-Signature — with the same value. From today only X-Quathos-Signature is sent. The signature, the secret and the t=<timestamp>,v1=<hash> format did not change: if your endpoint validates the old header by name, point it at the new one. The possession TXT record also moved to _quathos-verify; records already published as _qflaryx-verify keep working, with no action needed.
- feature
Monitor now tells you when the site is down
A tenth check, "server answering (HTTP)": we request the domain at the interval of your plan and alert when it stops responding — confirmed twice before alerting, and only after we have seen it up at least once, so a domain with no website never becomes a false alarm. One probe from one location, not a multi-region uptime monitor. The watched-domain quota is now on the pricing page as well.
- feature
Monitor: watch domains hosted anywhere
Prove ownership with a TXT record and we watch the domain without any nameserver change: delegation, DNSSEC chain and signature expiry, SPF/DMARC/MX, registration expiry and registry holds, the TLS certificate and certificates issued in CT logs. Alerts go out only on transitions, and "this was expected" stops a legitimate change from alerting again. Domains already served here are watched for free on every plan.
- feature
Secondary DNS now starts at Growth
Replicating a zone from your own primary over AXFR/IXFR with TSIG used to require the Scale plan. It now comes with Growth. Existing subscribers get it automatically — nothing to do.
- feature
Email security wizard (SPF and DMARC)
Pick your email provider and we write the records. The diagnosis also counts the DNS lookups your SPF requires — above 10 it silently stops working, and that is the most common SPF failure. DKIM is detected, never generated: the key belongs to your provider.
- feature
Audit log
Every change made in your organization — who, what, when, and the before/after. The record of a deleted item survives the item itself, which is the case people look up most.
- feature
Seven new record types, including editable DS
TLSA, SSHFP, SVCB, HTTPS, NAPTR, LOC and DS. The DS is what lets you delegate a subdomain to another operator while keeping the DNSSEC chain intact.
- feature
Team invitations
Invite people by email, set roles and revoke pending invitations. A pending invitation takes a seat on your plan until accepted or revoked — so the limit you see is the limit that applies.
- feature
Query analytics
Volume, most queried names and record types per zone, with retention by plan. There is no rcode breakdown: our current capture records the question, not the answer — and we do not publish numbers we do not measure.
- security
Per-plan API rate limits are now enforced
The requests-per-hour figure in the pricing table was published but never enforced. It is now applied per organization, with Retry-After on the 429 so automation knows how long to wait.
- infrastructure
Readiness checks real dependencies
/ready used to answer "yes" unconditionally. It now checks database, cache and the DNS backend, and returns 503 naming the component that failed — so a degraded instance stops receiving traffic instead of serving errors.
- feature
Public status page
Uptime and latency measured continuously and published as they are, including the days they look bad. A day that was not measured shows grey, never green.