HMAC-signed.
Retried. DLQ-backed.
Every mutation in your account fires a webhook. Signed, timestamped, retried with exponential backoff, and dead-lettered when your endpoint is down.
Every event.
One envelope.
Typed, versioned, and idempotent. Every payload includes a unique event ID, an idempotency key, and the full resource snapshot at the time of mutation.
HMAC-SHA256.
Timing-safe.
Every webhook is signed with your endpoint secret. The signature covers the timestamp and payload body to prevent replay attacks.
Exponential backoff.
With jitter.
Failed deliveries retry 5 times over 4 hours with exponential backoff and random jitter. After exhaustion, the event moves to the dead-letter queue.
| Attempt | Delay | Fired at | Status | Result |
|---|---|---|---|---|
| 1 | 0s | 14:02:14 | 500 | ✗ failed |
| 2 | 30s | 14:02:44 | 500 | ✗ failed |
| 3 | 2m | 14:04:44 | 500 | ✗ failed |
| 4 | 15m | 14:19:44 | 200 | ✓ delivered |
| 5 | 1h | --:--:-- | -- | -- skipped |
Nothing lost.
Ever.
When all retries are exhausted, events land in a dead-letter queue. Browse them in the dashboard, replay one at a time, or replay the entire backlog with a single API call.
- • 30-day DLQ retention
- • One-click replay per event
- • Bulk replay with filters
- • POST /v1/webhooks/dlq/:id/replay
- • DLQ depth metric in Prometheus
Thirty-four event types.
And counting.
Every mutation across DNS, domains, certificates, monitors, incidents, and status pages fires a typed webhook. Filter by event type at the endpoint level.
| Event type | Description |
|---|---|
| dns.zone.created | A new zone was added to the account |
| dns.zone.deleted | A zone was permanently removed |
| dns.record.created | A DNS record was created in a zone |
| dns.record.updated | A DNS record was modified |
| dns.record.deleted | A DNS record was removed |
| dns.bulk.completed | A bulk record operation finished |
| dns.propagation.complete | Global propagation confirmed |
| dns.dnssec.enabled | DNSSEC signing was activated |
| dns.dnssec.disabled | DNSSEC signing was removed |
| dns.dnssec.key_rotated | KSK or ZSK was rolled |
| domain.registered | A domain was purchased |
| domain.renewed | A domain renewal was processed |
| domain.transferred_in | An inbound transfer completed |
| domain.transferred_out | An outbound transfer completed |
| domain.expired | A domain reached its expiry date |
| domain.lock_changed | Transfer lock was toggled |
| domain.privacy_changed | WHOIS privacy was toggled |
| domain.ns_changed | Nameservers were updated at registrar |
| cert.issued | A new certificate was issued |
| cert.renewed | A certificate was auto-renewed |
| cert.revoked | A certificate was revoked |
| cert.expiring | A certificate expires within 14 days |
| cert.ct_detected | CT log detected issuance for your domain |
| monitor.created | A new monitor was configured |
| monitor.down | A monitor failed quorum check |
| monitor.up | A monitor recovered from failure |
| monitor.degraded | A monitor is responding slowly |
| monitor.ssl_expiring | Monitored SSL expires within 14 days |
| incident.created | An incident was automatically opened |
| incident.acknowledged | On-call engineer acknowledged |
| incident.resolved | An incident was marked resolved |
| incident.escalated | An incident was escalated to next tier |
| status_page.updated | A status page component changed state |
| webhook.endpoint.disabled | An endpoint was disabled after DLQ overflow |