The breach is never at your company
It is at a shipping portal, a conference registration site, a forum somebody signed up for with a work address in 2019. Nothing in your environment logs it, because nothing in your environment was involved.
DomainGuard · dark web monitoring
The breach that gets you happens somewhere else.
Nobody attacks your mail server any more. They buy a password your bookkeeper used on a site that got dumped four years ago, try it against the mailbox, and send an invoice from a real thread. DomainGuard watches a business address against known breach data and tells you when it turns up somewhere new.
Dark-web monitoring is a native tab in the DomainGuard iPhone app, which is in a public TestFlight beta. One monitored address is included on the free plan.
Why this one is watched for you
It is the only risk here you cannot go and check.
Every other module in DomainGuard reads a record that is sitting there waiting. This one is an event that happens to you elsewhere, which is why it is the one thing a free account gets automatically.
The password is the payload
An address on its own is a nuisance. An address paired with a password that also opens the mailbox is a takeover, and a mailbox takeover is how a fake invoice gets sent from a real thread.
You cannot check for it on demand
A domain's DNS is there to be re-read whenever you like. An address turning up in a dump is an event, and an event nobody is watching for is one you learn about afterwards.
What detection actually is
Five steps, and none of them are mysterious.
Dark-web monitoring gets sold with hooded figures. The mechanism is a hash, an index lookup, and a schedule.
- 01You add an addressOne on the free plan, five on Starter, ten on Pro, fifty on Enterprise. It is added in the DomainGuard iPhone app, where the feature lives.
- 02It is hashed before it is storedThe row holds a SHA-256 hash plus an encrypted envelope. The hash is what the system works with and what the app addresses the row by. The address itself never appears in a log or an audit entry.
- 03It is checked against a public breach indexThe upstream is an open breach index that maps an address to the incidents it appeared in and the categories of data each one exposed. Results are cached by hash, so two accounts watching the same address cost one lookup.
- 04You get the breach list, not a score aloneWhich incidents, what kind of data each exposed, and a risk reading derived from that. The useful output is a list of accounts to go change, in priority order.
- 05It re-checks on a scheduleManual, weekly or daily. This is the one automatic thing a free account gets, on purpose, because it is the one risk that cannot be found by pressing scan.
What it cannot do
Four limits, said out loud.
This category attracts more overselling than any other part of security software, so here is the boundary.
Nothing can remove your data from a breach
Once a dump exists it is copied. Any service claiming deletion from the dark web is selling you a feeling. What monitoring buys is knowing which credentials to rotate and how urgently.
Coverage is what the index has indexed
Known, catalogued breach corpora. A dump that has not been indexed, or that never became public, is not in there. A clean result means nothing known, not nothing exists.
It watches addresses, not whole domains
You name the addresses to watch, up to your plan's limit. DomainGuard does not enumerate every mailbox at a domain.
It lives in the iPhone app
There is no dark-web panel in the web dashboard. The rest of DomainGuard is on the web; this module is a native tab in the app, which is currently a public TestFlight beta.
What you get on each plan
One address free, forever, on a schedule.
Monitored addresses: 1 on Free, 5 on Starter, 10 on Pro and 50 on Enterprise. That number is the only part of dark-web monitoring that changes with the plan. The checking itself works the same on all four.
Free
Every health check on every domain you own, on demand — three watched for you
Free
No credit card. Nothing expires.
Unlimited domains · 3 watched automatically · On demand scans
Includes
- Domain Monitoring
- SSL Certificate Monitoring
- Email Security Score
- Security Checkup
- Vulnerability Scanner
- Site Check
Starter
DMARC reports, SEO and accessibility, Lookalike Watch, and 25 domains watched every night
$6.99/mo
Billed monthly. Cancel any time.
Unlimited domains · 25 watched automatically · Daily scans
Everything in Free, plus
- DMARC Reports
- SEO & Accessibility Scans
- Automatic Monitoring
- Lookalike Watch
- PDF Reports
Get the iPhone appStarter is bought in the DomainGuard iPhone app. Use the same email there as here and the dashboard unlocks as soon as Apple confirms it.
Best value
Pro
The local SEO suite, daily SEO scans and reports, read-only API and MCP access, 100 domains watched
$49.99/mo
Billed monthly. Cancel any time.
Unlimited domains · 100 watched automatically · Daily scans
Everything in Starter, plus
- Local SEO
- Daily SEO Scans and Reports
- API and MCP Access
Get the iPhone appPro is bought in the DomainGuard iPhone app. Use the same email there as here and the dashboard unlocks as soon as Apple confirms it.
Enterprise
Unlimited domains watched, hourly scans when you switch them on, and an API and MCP server that can make changes
$99.99/mo
Billed monthly. Cancel any time.
Unlimited domains · Unlimited watched automatically · Daily or hourly scans
Everything in Pro, plus
- Hourly Scans
- Priority Scanning
- API Writes
Get the iPhone appEnterprise is bought in the DomainGuard iPhone app. Use the same email there as here and the dashboard unlocks as soon as Apple confirms it.
Prices in USD. Paid plans are bought in the DomainGuard iPhone app through Apple, which works out any sales tax and sends the receipt. Cancel any time in your iPhone's Settings, under Subscriptions.
DomainGuard is pre-revenue — the app is in beta and nobody is subscribed yet.
Straight answers
Questions about breach monitoring.
Is this different from a free breach lookup site?
The lookup is similar. The difference is that this one keeps running. A one-off search tells you about breaches indexed before the day you searched, and the next one lands after you stopped thinking about it. DomainGuard re-checks the address on a schedule and tells you when the answer changes, and it does that on the free plan.
Do you store our email addresses?
As a SHA-256 hash and an encrypted envelope, never in the clear. The hash is the identity, the dedup key and the cache key, and it is what appears in audit records. The app addresses a monitored address by hash and never receives the ciphertext.
Can we monitor every address at our domain?
Not yet. Monitoring is per address. Domain-wide monitoring is on the list rather than in the product, and the app records that you asked for it so there is somebody to notify when it ships. An address at a domain that another DomainGuard account manages cannot be added, so one tenant cannot look up another company's staff.
What should we do when something comes back exposed?
Change the password on the breached service, change it anywhere it was reused, and turn on two-factor authentication on the mailbox first. If the exposed data includes anything beyond a password — security questions, a phone number, a physical address — treat those as public now. Our password checker is a reasonable next stop for testing what you replace it with.
Where does this sit next to email security?
It is the other half. Dark-web monitoring is about credentials that already leaked. Mail authentication and inbound filtering are about messages arriving now. DomainGuard covers the first and reports on your SPF, DKIM and DMARC posture; NHM's managed email security is the filtering layer, and that is a separate service.
Check one address
Start with whoever pays the invoices.
That address is the one attackers want, and the free plan monitors one. Dark-web monitoring is a tab in the DomainGuard iPhone app, which is free to join on TestFlight while it is in beta.