document how to deal with another nagios warning

howto/dns.md

@@ -323,6 +323,28 @@ attempt.
 Typically, this is because a change in `tor-puppet.git` was forgotten
 (in `named.conf.options` or `named.conf.puppet-shared-keys`).
 
+### DNS - DS expiry
+
+Example:
+
+    2023-08-22 16:34:36 <nsa> tor-nagios: [global] DNS - DS expiry is WARNING: WARN: torproject.com, torproject.net, torproject.org : OK: 4
+    2023-08-26 16:25:39 <nsa> tor-nagios: [global] DNS - DS expiry is CRITICAL: CRITICAL: torproject.com, torproject.net, torproject.org : OK: 4
+
+Full status information is, for example:
+
+    CRITICAL: torproject.com, torproject.net, torproject.org : OK: 4
+    torproject.com: Key 57040 about to expire.
+    torproject.net: Key 63619 about to expire.
+    torproject.org: Key 33670 about to expire.
+
+This is Nagios warning you the DS records are about to expire. They
+will still be renewed so it's not immediately urgent to fix this, but
+eventually the [DS records expiry and renewal](#ds-records-expiry-and-renewal) procedure should be
+followed.
+
+The old records that should be replaced are mentioned by Nagios in the
+extended status information, above.
+
 ## Disaster recovery
 
 <!-- what to do if all goes to hell. e.g. restore from backups? -->