Critical-severity escalation

When a Critical-severity alert fires and nobody acknowledges it within 15 minutes, DomainCare re-dispatches it to the next channel in your escalation order. This ensures that a site-down or expired certificate does not go unnoticed because the first message was missed.

Escalation is available on all paid plans.

How it works

1. A Critical-severity event is emitted (for example, website_down or ssl_cert_expired).
2. DomainCare dispatches the alert to all eligible channels immediately.
3. A 15-minute delayed step is scheduled.
4. If the event has not been acknowledged when the step fires, DomainCare dispatches again to the next channel in the escalation order.
5. Escalation repeats up to 3 hops per event. After 3 escalations the event is considered exhausted and no further dispatches occur.

Each escalation step is recorded in the event timeline as:

Escalated to Slack after 15 min (unacknowledged)

Only Critical-severity alerts escalate. Needs-attention and Low events go to digest or direct dispatch but do not trigger the escalation timer.

Escalation channel order

The default order is: email → Slack → webhook.

To change the order:

1. Go to Settings → Notifications.
2. Under Escalation order, drag channels into the sequence you want.
3. Save. The new order applies to all future Critical-severity events.

The escalation order is stored per org. Per-domain overrides use the same org-level order.

Acknowledging an alert

Acknowledging an alert stops the escalation timer. There are three ways to acknowledge:

From email — every Critical-severity email contains a one-click acknowledgement link. The link is signed with HMAC and does not require you to be logged in. Clicking it marks the event acknowledged immediately.

From the dashboard — find the event in the domain's event timeline and click Acknowledge.

From the domain detail banner — any open Critical-severity event shows a banner at the top of the domain detail page with Acknowledge and Dismiss buttons.

Acknowledgements are stored with the acknowledging user's ID for audit purposes.

What counts as "acknowledged"

The acknowledged_at timestamp is set when:

• The account owner clicks the one-click link in the escalation email.
• The account owner clicks Acknowledge in the dashboard or domain detail page.

Resolving the underlying issue does not automatically acknowledge the event. The alert for a recovered domain (website_back_online) is a separate event — it does not close the original website_down escalation timer.

Quiet hours and escalation

Quiet hours defer Needs-attention alerts to digest but do not defer Critical-severity alerts. Critical-severity events always dispatch immediately, and their escalation timers always run — even during a configured quiet window.

Common questions

What happens if I only have one channel configured? Escalation dispatches to the same channel again. Add a second channel and set the escalation order to avoid duplicate messages on the same destination.

Can I change the 15-minute window? The 15-minute escalation interval is fixed and not user-configurable.

Does escalation work during maintenance windows? No. If a domain is inside a maintenance window, all notifications for that domain are suppressed, including escalation re-dispatches.

What if the event recovers before 15 minutes? If the issue resolves and a recovery event arrives before the escalation step fires, DomainCare still checks acknowledged_at — not the recovery event — before re-dispatching. Acknowledge the original alert to prevent the escalation message.