DomainGuard for agencies
You did not buy it, you do not hold the card, and the renewal notice went to an inbox on the domain that just stopped resolving. It is still your phone that rings. DomainGuard keeps one list of every client domain you touch — expiry, certificates, mail authentication, uptime and lookalikes — and tells you first.
DomainGuard is in a public TestFlight beta and is not on the App Store yet. The web dashboard is live, and the free plan needs no card.
How it actually goes wrong
Client domains break quietly, in four familiar shapes. Every one of them is invisible from your project tool and obvious from a registry lookup.
Month 14
Auto-renew fails silently. The renewal notice goes to an address on the domain that is about to stop resolving, so nobody reads it. DomainGuard reads the registry record itself and warns you in its app and on the dashboard, not at an inbox on their domain.
The Friday deploy
The main site renews automatically. The client portal on a second host does not. Certificate expiry is tracked per host, so the alert names which one rather than saying something is wrong.
A month after the migration
Marketing signed up for something and edited a record without telling anyone. SPF, DKIM and the DMARC policy get re-checked and the change is stored as a diff against the last scan.
Once they are worth impersonating
Almost never to build a website. It is registered to send invoices. The lookalike watch scores the registration, its mail records, and whether the page copies the client's own homepage.
One list, every registrar
A defensive .net at one registrar, the main name at another, a client account you have view access to. There is no single dashboard because there is no single account, so the list has to live outside all of them.
Sort domains into groups you name, one per client if you like, so a name sitting in somebody else's registrar account is still a name on your list. Every plan holds unlimited domains. What a plan buys is how many are watched without being asked.
Alerts are pushed to the DomainGuard app on your phone and listed on the dashboard's Alerts page, so none of them depends on the domain being monitored. The reason registrar warnings get missed is that the alarm is wired to the thing it is meant to protect.
Scan history, DNS diffs, certificate timelines and uptime windows are kept per domain, so “when did this change” has an answer that is not somebody's memory.
The part almost nobody else has
DomainGuard ships an MCP server at /api/mcp. Point Claude, or any MCP client, at your own account with an API key and ask in words instead of clicking through a dashboard. Read access is on Pro; Enterprise adds the write scope.
Things an account manager actually asks
A key carries resource scopes, and the plan is re-read on every call. A read-only key cannot start a scan, spend a credit or change a record, so handing one to an assistant is not handing it the account.
For an agency the useful part is the monthly client update nobody wants to write. The data is already structured. The assistant does the assembling.
Read the full MCP referenceWhere the line is
Passive checks read what a site already publishes and run on any domain. Port scanning and the active vulnerability scanners need proof of control (a DNS record, a file on the site, an email link, or a sign-in address at the domain), valid for 90 days. Agencies with many client domains can ask us to approve the account for deep scans of all of them.
For an agency that is a feature, not an obstacle. You can prove control of the sites you run, and the gate is what stops the same platform your clients' scans run on from being pointed at somebody else's infrastructure. DomainGuard also never edits DNS, a registrar record or a website. It finds, records and recommends. The change stays yours.
What it costs
The free plan holds every domain you manage and runs every health check on demand, with no card and no expiry. What free does not include is monitoring that runs while nobody is looking.
Every health check on every domain you own, on demand — three watched for you
Free
No credit card. Nothing expires.
Unlimited domains · 3 watched automatically · On demand scans
Includes
DMARC reports, SEO and accessibility, Lookalike Watch, and 25 domains watched every night
$6.99/mo
Billed monthly. Cancel any time.
Unlimited domains · 25 watched automatically · Daily scans
Everything in Free, plus
The local SEO suite, daily SEO scans and reports, read-only API and MCP access, 100 domains watched
$49.99/mo
Billed monthly. Cancel any time.
Unlimited domains · 100 watched automatically · Daily scans
Everything in Starter, plus
Unlimited domains watched, hourly scans when you switch them on, and an API and MCP server that can make changes
$99.99/mo
Billed monthly. Cancel any time.
Unlimited domains · Unlimited watched automatically · Daily or hourly scans
Everything in Pro, plus
Prices in USD. Paid plans are bought in the DomainGuard iPhone app through Apple, which works out any sales tax and sends the receipt. Cancel any time in your iPhone's Settings, under Subscriptions.
Plans are bought through Apple in-app purchase. DomainGuard is pre-revenue and the iPhone app is still in beta, so what you can use today is the free plan and the TestFlight build.
Before you add the first client
No. Expiry, nameserver, certificate and mail-authentication data all come from public records (DNS, RDAP and certificate transparency), so you can watch a domain you do not hold the login for. The deep scans (open ports, known vulnerabilities) need proof that you control the domain, which does not need the registrar login either. That matters, because the domain a former developer registered on their own account is usually the one that lapses.
No, and it will not pretend to. DomainGuard scans, records and alerts. Renewing happens at the registrar and DNS changes happen at the DNS provider. What it does is tell you which domain, which record, and how long you have.
Passive checks (DNS, certificates, mail authentication, security headers, technology detection) run on any domain you add, because they only read what a site already publishes. Port scanning and the active vulnerability scanners need proof that you control that specific domain: a DNS record, a file on the site, or an email link to an address at the domain, valid for 90 days. A verified sign-in address at the domain counts too. For client sites you cannot prove, ask us to approve the account for deep scans of any domain. It is a deliberate limit. An unauthenticated port scanner pointed at strangers is how a platform account gets banned, and an agency can prove control of the sites it runs.
PDF reports start on Starter at $6.99 a month, alongside the nightly re-scan and the alerts it raises. On Pro and Enterprise the API and MCP server let you pull the same data into whatever you already send.
Nothing. The free plan holds every domain you manage and runs every health check on demand, with no card and no expiry. What free leaves out is the part that runs while you are not looking: the nightly re-scan and the change alerts that come from it start at $6.99 a month. The iPhone app is in a public TestFlight beta and is free to join.
Add the client list
Put every domain you manage in the free plan and run the checks yourself. The iPhone app is in public beta on TestFlight, free to join, and signs in with the same account.
