Buyer's guide

Domain monitoring tools, compared by what they actually cover.

We sell one of the things on this page, so read it with that in mind. What follows is five categories scored against eight criteria that are defined first, plus a section listing where our own product is currently the weaker choice. No competitor prices, because a price quoted on a page like this is stale within a quarter and you have no way to tell which one went bad.

Run the free checkup Create a free account

The checkup asks for a free account before it shows the report, and the free tools refuse to scan banks, government sites and the major platforms. No card either way.

The criteria, first

Eight questions, written before anything was scored.

Registration expiry

Does it read the registry record and warn you on a ladder of dates, or does it rely on the registrar emailing the address on the registration?

DNS change detection

Does it keep the previous answer and diff it, or does it only tell you the current state when you go and look?

Certificate expiry

Does it read the certificate the server presents, including on subdomains and non-web services, and warn before the browser interstitial?

Mail authentication

Does it read SPF, DKIM, DMARC and MX and tell you what is wrong, and does it process the DMARC aggregate reports mailbox providers send back?

Impersonation

Does it look for names registered to look like yours, in registration data and Certificate Transparency logs, and tell you when one gains mail or a certificate?

Vulnerability signal

Does it identify software your site discloses and tell you when a vulnerability in it is published, and does it prioritize by known exploitation rather than raw CVSS?

Alert routing

Where does an alert go, who can receive it, and can you send a domain to a client or a colleague without giving them your whole account?

What it costs to find out

Can you see the price and start, or is the first step a sales call and a quote?

The matrix

Category against criterion.

These are category judgments, not product tests. Individual products move within their category, and a few straddle two. Use it to work out which category you need, then check the specific product against the criteria yourself.

Domain monitoring tool categories scored against eight coverage criteria
Criterion	Registrar-bundled alerts	Uptime-only monitors	Enterprise brand-protection suites	DIY scripts	All-in-one domain health
Registration expiry	Partly	No	Yes	You build it	Yes
DNS change detection	No	No	Partly	You build it	Yes
Certificate expiry	No	Partly	Partly	You build it	Yes
Mail authentication	No	No	Partly	You build it	Yes
Impersonation	No	No	Yes	No	Yes
Vulnerability signal	No	No	No	No	Yes
Alert routing	No	Yes	Yes	You build it	Partly
What it costs to find out	Yes	Yes	No	Yes	Yes

The categories in full

What each one is good at, and where it stops.

Registrar-bundled alerts

The notifications built into any ICANN-accredited registrar account

Renewal reminders and, at some registrars, a basic DNS or certificate notice. It is bundled because it has to be: ICANN's Expired Registration Recovery Policy requires a registrar to send a renewal reminder roughly a month before expiry, another about a week before, and one after the domain expires if it deletes it.

Strongest at: It is free, it already exists, and for a single domain with a current card and a monitored mailbox it genuinely works.
Where it stops: It only knows about domains at that registrar, it only mails the registrant address on the registration record, and it tells you nothing about DNS drift, mail authentication, certificates on other hosts, or anyone registering a name that looks like yours. Split a portfolio across three registrars and you now have three partial views and no list.
Fits: One or two domains, one registrar, and someone who reads that mailbox.

Uptime-only monitors

The category built around synthetic checks — Pingdom, UptimeRobot, Better Stack and similar

A request to your URL every minute or five from several locations, with an alert when it fails or slows. Most of them also read the certificate expiry date while they are there, because they already have the TLS handshake.

Strongest at: Nothing beats them at the thing they do. Minute-level detection and a real on-call escalation path are worth paying for if downtime costs you money.
Where it stops: The domain layer is out of scope. Uptime tools do not read your registration record, do not diff DNS, do not read SPF or DMARC, and do not care what software your site is running. A domain can pass every uptime check for months and expire on a Thursday.
Fits: Anyone who needs minutes-not-hours downtime detection, alongside something that watches the rest.

Enterprise brand-protection suites

Corporate domain management and brand-protection vendors such as MarkMonitor and CSC

Corporate registrar services plus monitoring of registrations, marketplaces, app stores and social handles, with enforcement (takedowns, UDRP filings, legal work) attached as a service.

Strongest at: The enforcement is real. If your problem is a hundred infringing registrations a quarter and you need someone to actually file, this category is what that job looks like.
Where it stops: Pricing is quoted rather than published, and the entry point is a sales conversation, which by itself rules the category out for most businesses under a few hundred people. The technical health of your own domains, meaning mail authentication, certificates and security headers, is usually a smaller part of the product than the brand-abuse side.
Fits: Companies with a trademark portfolio, a legal budget, and a volume of abuse that justifies retained enforcement.

DIY scripts

cron, dig, openssl, an RDAP query, and a webhook into chat

The checks are all public queries, so you can write them. An RDAP lookup gives you the expiry date as JSON. openssl gives you the certificate end date. dig gives you the current DNS answer, and a file of yesterday's answers gives you the diff.

Strongest at: Free, exact, and yours. For a technical team with a handful of domains this is a genuinely good answer, and it is the honest recommendation more often than a vendor will say.
Where it stops: It is code nobody owns. The failure mode is not a wrong answer, it is a cron job that stopped in March and a Slack channel that has been quiet ever since, which reads exactly like good news. The parts that are hard to build yourself are the ones with real work behind them: parsing DMARC aggregate XML into something readable, matching disclosed software versions against a vulnerability feed, and watching Certificate Transparency for lookalike names.
Fits: Technical teams, few domains, and someone whose job includes noticing that the job stopped.

All-in-one domain health

DomainGuard, and others positioned the same way

One account holding every domain regardless of registrar, re-reading registration, DNS, certificates, mail authentication, security headers and disclosed software on a schedule, with the previous answer kept so the alert is about the change.

Strongest at: One list. The value is not any single check, because every check here is public data. It is that nobody has to remember which of the five tools covers the thing that just broke.
Where it stops: It is not an uptime tool with a real on-call rotation, and it is not an enforcement service. It finds the lookalike domain and hands you the evidence; filing the complaint is still yours.
Fits: A business with more domains than people who think about domains.

If you are going to build it

Three of the checks, as one-liners.

These are the public queries every tool on this page is built on. Run them yourself before you buy anything, on a domain you own. If they answer the question you had, you may not need a product at all.

Registration expiry date, from the registry, as JSON

curl -s https://rdap.org/domain/yourdomain.com | jq -r '.events[] | select(.eventAction=="expiration") | .eventDate'

Certificate expiry date, from the server actually answering

echo | openssl s_client -servername yourdomain.com -connect yourdomain.com:443 2>/dev/null | openssl x509 -noout -enddate

Your DMARC policy, as published right now

dig +short TXT _dmarc.yourdomain.com

Against us

Where DomainGuard is currently the weaker choice.

Every item here is true today and some of it will stop being true. None of it is written to be charming. If two or three of these matter to you, buy something else and come back later.

The iPhone app is a public TestFlight beta, not an App Store release. It is pre-1.0 software and it behaves like it: you will find rough edges, and reporting them is the deal.
There is no Android app. Android users get the web dashboard in a mobile browser, which works but is not the same product.
The web dashboard is dark theme only. There is no light mode, and if that is a problem for you it is a real problem, not a preference we will talk you out of.
Plans are sold through Apple in-app purchase only. There is no web card checkout today, so buying a plan means an iPhone or iPad.
We are pre-revenue. Nobody is paying for this yet, so there are no customer numbers, no case studies and no reviews to point at, and anyone who shows you those on a product this young made them up.
Uptime detection is not minute-level on every plan, and there is no phone-tree escalation. If a five-minute outage costs you real money, pair this with a dedicated uptime tool.
We do not file takedowns for you. We find the lookalike, collect the evidence, and tell you where to send it.

Before you buy anything

Five questions to put to any vendor, including us.

Where does the expiry date come from?

The registry record is authoritative. A tool that reads your registrar's dashboard only knows about domains at that registrar, and a tool that scrapes a cached WHOIS answer can be days stale. Since January 2025 the definitive source for gTLD registration data is RDAP, not WHOIS.

Do you keep the previous answer?

Change detection is impossible without history. If a tool only shows current state, every alert it can send is really a threshold, not a change.

What happens when a check fails to run?

A scan that errors and reports nothing looks identical to a scan that passed. Ask how a failed check is surfaced, because that is the failure that costs you a domain.

Can I see it without talking to anyone?

Not a moral question, a fit question. If the first step is a quote, the product is priced for a buyer with a procurement process.

What does it explicitly not do?

Any vendor who cannot answer this quickly has not thought about it, and you will find the answer yourself during an incident.

Check a domain now Compare plans

Questions people actually ask

Is my registrar's built-in reminder enough?

For one domain, with a card that is current and a registrant email somebody reads, often yes. It stops being enough the moment you have domains at more than one registrar, because no registrar can show you a list of names it does not hold, and it never covered DNS drift, mail authentication or certificates in the first place.

Can I just use an uptime monitor?

An uptime monitor is the right tool for downtime and nothing else. Most read the certificate expiry date as a side effect of the TLS handshake, which is a genuinely useful freebie. None of them read your registration record, diff your DNS, or read a DMARC report.

Should I build this myself?

If you have a handful of domains and someone technical, yes, and we would rather say so than pretend otherwise. RDAP, dig and openssl give you expiry, DNS and certificate checks in an afternoon. The parts that are hard to build are DMARC aggregate XML parsing, matching disclosed software versions against a vulnerability feed, and watching Certificate Transparency for lookalikes.

Why does this page not list competitor prices?

Because a price we quote today is wrong within a quarter and you would have no way of knowing which claim went stale. Categories and criteria hold their shape. Check the current price on the vendor's own page.

What does DomainGuard cost?

Free for unlimited domains checked on demand. Starter is $6.99 a month or $69.99 a year for 25 domains watched automatically, Pro is $49.99 a month or $499.99 a year for 100 plus the SEO suite and read-only API access, Enterprise is $99.99 a month or $999.99 a year. Plans are bought through Apple in-app purchase.

What domain monitoring is

The five layers a domain is made of, and how each one fails.

Expiration monitoring

Grace, redemption, pending delete, and why auto-renew is not an answer.

Website security monitoring

What can be checked from outside your site, and what cannot.

Website security checklist

Items to work through, each with a command to verify it yourself.

DomainGuard pricing

What each plan buys, and what the free account already covers.

The MCP server

Connect your DomainGuard account to Claude and ask it about your domains.