# agent health check hit the workers.dev url: missed the custom-domain-only bug

## TL;DR

The health check hit the workers.dev URL, which bypasses the custom domain's DNS, TLS, and routing, so a custom-domain-only bug went unnoticed. Check the production domain itself (and each domain) for health. The check must exercise the real path.

```text
agent health check hit the workers.dev url: missed the custom-domain-only bug
```

## Steps

1. Confirm the gap: the workers.dev URL works while the custom domain fails.
   Expected: The domain-specific bug is reproduced.

2. Point the health check at the custom domain (all of them, if several).
   Expected: The real path is exercised.

3. Cover DNS, TLS, and routing in the check, not just HTTP 200.
   Expected: The domain-specific layers are tested.

4. Keep a workers.dev check too, as a control: it distinguishes platform issues from domain issues.
   Expected: The two checks complement each other.

5. Alert on domain-check failure distinctly.
   Expected: The signal is clear.

## When to use

- workers.dev is healthy but the domain is not
- health checks use the dev URL
- custom-domain bugs escape

## When not to use

- there is no custom domain (then workers.dev is the real path)
- the domain check also passes (the bug is elsewhere)
- the bug is not domain-specific (the dev URL would catch it)

## Tool compatibility

- wrangler
- custom domains

## Variant phrasings

- "health check workers.dev missed domain bug"
- "custom domain bug not caught"
- "check production domain not workers.dev"

## Why it happens

The workers.dev URL is the platform's direct address: no custom DNS, no custom TLS cert, no domain routing rules. Bugs live in exactly those layers (a bad cert, a DNS misconfig, a route shadowing). Checking only workers.dev tests the platform, not the product. The product lives on the domain.

## Edge cases

- check every custom domain, not just the primary
- the control check (workers.dev) is genuinely useful for triage
- TLS expiry on the custom domain is the classic missed bug; monitor it

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_CS5p0PXVM2WoBjj8z8LIJQ