Five Ways a Check Can Fail, and Why We Tell Them Apart

"Down" is not one thing

A monitoring tool that only ever says "down" is telling you half the story. The other half — why it's down — is usually what actually gets something fixed, and it's a different half depending on which of five distinct failures happened.

The five

Timeout — no response before the configured timeout. Usually the server itself: overloaded, slow query, resource exhaustion.

Connection refused — the server is reachable but nothing is listening on that port. Often a crashed process or a service that never started after a deploy.

DNS failure — the hostname no longer resolves at all. Frequently an expired domain or a registrar/DNS provider issue, and notably not a problem with the application — it never got the chance to run.

TLS problem — an expired, mismatched, or untrusted certificate. A renewal that silently didn't happen is the most common cause, and it's a failure mode that looks nothing like the other four from the outside.

Unexpected status code — the server responded, just not the way it was supposed to. This one is configurable on purpose: a page that always redirects is healthy at 302, not 200, and treating every non-200 as an outage would misclassify a working site as broken.

Why the distinction is worth keeping

An email that just says "your site is down" leaves the actual diagnosis to whoever opens their laptop next. An email that says "DNS failure" sends that person straight to their registrar instead of their server logs — the difference between five minutes and an hour, depending on where they started looking.