Compliance probes and domain health

Google certifies transparent click trackers and can withdraw certification if a tracker stops behaving transparently. TrackCrown therefore tests its own tracking domains around the clock the way Google's systems call them, and watches certificates, uptime and domain reputation. Problems open incidents that are e-mailed to platform administrators.

Compliance probes#

Every 5 minutes, for every active tracking domain, the worker sends synthetic requests:

Each request must:

1. answer 302;
2. have a Location byte-for-byte equal to the url= value (plus only the workspace's own click-ID parameter when Append the click ID to transparent redirects is on);
3. set no cookie;
4. answer within 300 ms (time to first byte);

and per domain the certificate must be valid for more than 14 days.

The hostname is resolved through public DNS (1.1.1.1 / 8.8.8.8) and only public addresses are called, so the probe sees what Google sees. Probe requests carry a signed X-ArcTrack-Probe header (a fixed technical name, the same for every brand): the edge marks those clicks as test clicks — excluded from reports, caps and billing — and never answers them differently.

A failing domain opens the incident probe:<domain>; the next passing run resolves it. Probe runs are kept 30 days.

Certificate monitoring#

Every hour the worker opens a TLS connection with SNI to every active domain (tracking, panel and marketing):

The result is stored on the domain (expiry, issuer, error) and shown in the TLS column of Tracking → Tracking domains and Admin → Domains. Certificates are issued and renewed automatically; an expiry incident usually means the domain's DNS no longer points at the platform.

Domain reputation#

Once a day per tracking domain (the job wakes hourly) the hostname and its registrable domain are looked up in:

A listing opens the incident reputation:<domain>:<source>, resolved when a later lookup is clean. Refused queries (Spamhaus answers public resolvers with 127.255.255.x) count as unknown, never as listed.

Separately, with Web Risk configured every destination host your links redirect to is checked every 30 minutes; the edge refuses links to flagged hosts with an error page.

Unknown link keys#

When an unknown or deleted link key receives more than 10 hits in an hour (checked every 10 minutes), an incident is opened — usually an old link still running in an ad.

Incidents#

• Opening an incident e-mails every active platform administrator; for a workspace's own domain the workspace's staff are also notified in-app.
• A failing check that keeps failing only updates the open incident; there is one open incident per check.
• Resolving sends a short recovery e-mail.
• Admins can Acknowledge an incident to show it is being handled.

Domain health page#

Platform admins open Admin → Domain health (/admin/domains/health):

• KPI cards: Tracking domains, Passing probes, Failing probes, Open incidents (with the number of critical ones).
• A table per domain: Domain, Probe (Passing, N failing or No run yet), Pass rate 24 h, TTFB p50 / max, Certificate (days left or TLS error) and Last run.
• Open incidents with severity, Acknowledged and Resolved badges.
• Latest probe of <domain> (choose the Domain and click Show): each check, the Failing checks, the Affected workspaces and offers, a daily uptime bar and the reputation badges ("Reputation not checked yet (daily)." until the first lookup).

*.localhost names are never probed.

What workspace staff see#

Workspace staff do not have the health page, but they see the TLS state of their domains on Tracking → Tracking domains and receive in-app notifications about incidents on their own domains.

Related#

• Transparency and certification
• Security overview