Glossary
45 monitoring, SSL, DNS and email terms, explained without the jargon
When a check fails, the app tells you exactly what it found — an expired certificate, a missing DNSSEC signature, a weak cipher. This page explains what those things actually mean and why they matter, in the order you are most likely to meet them.
Monitoring basics
- Uptime
- The proportion of time a site answers checks successfully. Usually quoted as a percentage over a period, so 99.9% over a month allows roughly 43 minutes of downtime.
- Downtime
- Any period where a check fails: the server does not respond, or it responds with an error. Beyond Site records the start and end of each failure so you can see how long an outage lasted.
- Response time
- How long the server took to answer, measured from the request being sent to the first byte coming back. A site can be up and still be slow enough to lose visitors.
- HTTP status code
- The three-digit number a server returns with every response. It is the single clearest signal of whether a request succeeded, redirected, or failed.
- 2xx, 3xx, 4xx and 5xx
- The four families of status code. 2xx means success, 3xx means the request was redirected elsewhere, 4xx means the request was rejected (a missing page, a blocked client), and 5xx means the server itself failed. Only 2xx and 3xx count as healthy for monitoring.
- Redirect chain
- The sequence of hops a request follows before it reaches its final destination, for example HTTP to HTTPS, or a bare domain to www. Long chains slow every visit down and are easy to break.
- Check interval
- How often a site is tested. Shorter intervals catch problems sooner but cost more battery and traffic, so Beyond Site lets you set a refresh timer rather than fixing one rate.
- Monitoring log
- The running history of every check performed against a site: when it ran, what status came back, and how long it took. It is what turns a single result into a trend you can act on.
SSL and certificates
- SSL / TLS certificate
- A file a server presents to prove it owns the domain it claims to. Browsers use it to encrypt the connection, which is why an invalid certificate triggers a full-page warning. TLS is the modern name for what is still widely called SSL.
- Certificate expiry
- The date a certificate stops being trusted. Public certificates are now limited to a maximum lifetime of about a year, so expiry is the single most common cause of a site suddenly breaking. Beyond Site tracks days remaining and warns you long before the date.
- Certificate Authority (CA)
- The organisation that signed the certificate, such as Lets Encrypt, DigiCert or Google Trust Services. Knowing the issuer tells you who to contact when a renewal fails.
- Issuer
- The specific signing authority named inside a certificate. It should match the CA you expect, and a mismatch is worth investigating.
- SAN (Subject Alternative Name)
- The list of hostnames a single certificate covers. A certificate for example.com may also cover www.example.com and mail.example.com. Checking the SAN list is how you confirm a name is genuinely covered rather than assuming it is.
- Certificate chain
- The path of certificates from the one your server presents up to a root the browser already trusts. A missing intermediate certificate in the middle of that chain is a classic cause of errors on some devices but not others.
- TLS handshake
- The opening exchange where client and server agree on a protocol version and encryption method and validate the certificate. If the handshake fails, nothing else gets a chance to work.
- Cipher suite
- The specific set of algorithms used to encrypt a connection. Old servers often still offer weak or obsolete suites, which is a real security weakness even when the site loads fine.
- Security grade
- A summary letter, A through F, of how well a server is configured: which protocol versions and cipher suites it accepts and whether the chain is complete. It is a shorthand for the overall quality of the setup.
DNS and networking
- DNS (Domain Name System)
- The system that translates a name people can read, like example.com, into the numeric address computers use. Almost every website problem starts as a DNS problem, which is why it is checked first.
- DNS record
- A single entry in a domain’s DNS configuration. Each record type answers a different kind of question, and reading them together is how you understand how a domain is set up.
- A record
- Points a hostname at an IPv4 address, the most common form such as 203.0.113.10.
- AAAA record
- The same as an A record but for an IPv6 address. Sites that publish only an A record are unreachable over IPv6.
- CNAME record
- An alias that points one hostname at another rather than at an address, so www.example.com can simply follow wherever example.com points.
- MX record
- Directs email for a domain to its mail servers. If the MX records are wrong or missing, mail silently fails to arrive even though the website works perfectly.
- TXT record
- A free-text record used to carry verification data and email authentication policies such as SPF and DMARC.
- CAA record
- Names which certificate authorities are allowed to issue certificates for the domain. It is a guard rail that stops an unauthorised CA from issuing one.
- SOA record
- The record that identifies the authoritative nameserver for a domain and carries its timing defaults. It is the anchor the rest of the zone hangs from.
- DNSSEC
- A set of extensions that cryptographically sign DNS answers so they cannot be forged in transit. It prevents a whole class of attacks where a tampered response redirects visitors somewhere else.
- DNS propagation
- The delay while a DNS change spreads to resolvers worldwide. Because cached copies expire on their own schedules, different people can see different answers for hours after an edit.
- Nameserver
- The server that holds the authoritative DNS records for a domain. If a nameserver is unreachable, the whole domain becomes unresolvable.
- TTL (Time To Live)
- How long a resolver may cache a DNS answer before asking again. A high TTL means fewer lookups but slower propagation when you change something.
- TCP and port
- TCP is the underlying transport protocol, and a port is the numbered channel a service listens on. Common examples are 443 for HTTPS and 25 for SMTP. A port can be closed on the server even while the website itself responds.
- Ping
- A minimal reachability test that asks whether a host responds at all. It confirms the network path is open before you investigate anything higher level.
Email authentication
- SPF (Sender Policy Framework)
- A DNS record listing which servers are permitted to send email for a domain. Without it, anyone can send mail claiming to be from your domain.
- DKIM (DomainKeys Identified Mail)
- A cryptographic signature added to outgoing mail so the receiving server can verify it was not altered on the way and genuinely came from the domain.
- DMARC
- A policy that tells receiving servers what to do when mail fails SPF or DKIM checks, and where to send reports. It ties the other two together and is what makes them enforceable.
- Reverse DNS (PTR)
- A lookup that goes the other way, from an IP address back to a hostname. Mail servers commonly reject connections from addresses with no matching reverse DNS.
- Open relay
- A mail server that forwards mail for anyone who asks, including spammers. It is a serious misconfiguration and a reliable route onto blocklists.
- SMTP
- The protocol used to send email. Beyond Site can test an SMTP server directly to confirm it accepts connections and starts a secure session.
How Beyond Site works
- On-device check
- Every test runs locally on your own phone or tablet and connects straight to the site you asked about. There is no developer-operated server in the middle, so your data is never transmitted to us.
- Background refresh
- Checks continue on a schedule while the app is closed, so a certificate that expires overnight is already known about before you next open it.
- Three-tier threshold
- The Green, Yellow and Red bands you set for certificate expiry. They decide how much warning you get, from a gentle heads-up to an urgent alert.
- Push notification
- A device-level alert delivered by iOS, so a change in status reaches you without the app being open.
- Scheduled downtime
- A window where monitoring is deliberately paused, for planned maintenance, with automatic resume when the window ends. It stops planned work from generating a page full of false alarms.
- Group security scan
- A single scan run across every site in a category, so a whole client estate or project can be checked at once instead of one domain at a time.
- CSV import and export
- Your site list and alert settings can be written out as a plain spreadsheet file and read back in. It is a backup you control and a way to move between devices.
Putting it into practice
See these signals on a real screen, or read what the app checks in full
User Guide
A walkthrough of the app screen by screen, so you can see where each of these results appears and what it is telling you.
Features
The complete list of what Beyond Site checks, from availability and response time through to certificate chains and DNS records.
Missing a term?
If something the app reported is not explained here, tell us and we will add it. That is how this page gets better.