Alerts and notifications

An alert in DomainGuard is a record: what happened, on which domain, when, how it was delivered, and what to do next. The feed is the same on the web and in the app, and alerts reach the iOS app wherever it is signed in: by default as one summary push each morning, with only a site going down, a vendor incident or a subdomain someone else could claim pushed during the day. Uptime, provider status, breach hits and KEV or CVE matches work on every plan; the alerts the nightly re-scan raises (change events, renewal, certificate, DNS records, security score), DMARC and lookalike alerts start at Starter.

Articles

• The alerts feed - Open and Read, swipe actions, Mute 7 d, the badge, alert detail, and the History ledger.
• Notification settings - every switch, its default, which plan it needs, and what actually reads it.
• Push notifications and quiet hours - the morning summary, the server-side senders, the app's own notices, and the quiet window.
• Provider status monitoring - live status of the DNS host, mail provider, registrar and other vendors your domains use.

Where

• Web: the Alerts page in the dashboard (with an unread count); Settings, Notifications for the switches.
• iOS: the Alerts tab (badge = open count); Account, Settings, Notifications for the switches.
• API/MCP: GET /api/notifications, GET /api/notifications/activity, POST /api/notifications/read; tools list_alerts, get_alert_activity, mark_alerts_read, get_account_settings, update_account_settings.

Three facts to keep straight

1. The feed is the record; the push is a copy. An alert is in the feed whether or not the push was delivered, and the alert's detail shows every delivery attempt.
2. There is no alert email. Every alert goes to the feed and to the app, on every plan. What a plan changes is which alerts can be raised: a Free account gets site down and recovered, provider incidents, breach hits, KEV and CVE matches and scan-finished. Change-event ("Did you make this change?"), renewal, certificate, DNS-record, security-score, DMARC and lookalike alerts are Starter and up. If you only use the web, you see alerts in the Alerts page; there is no web push.
3. One push a morning, by default. With One summary each morning on (the default since 2026-10-01), alerts arrive as one push around 8 a.m. Eastern. Between 8 a.m. and 5 p.m. only a site going down, a vendor incident or a subdomain someone else could claim pushes on its own, and nothing pushes after 5. Turn the summary off to get each alert as it is found. See Push notifications and quiet hours.

What is an alert and what is not

An alert is an event the account was told about: a finding raised, a change detected, a site down or recovered, a provider incident, a breach hit, a DMARC sender, a KEV match, a scan finished, a new subdomain or admin service, a problem fixed. A finding on a domain page is not an alert until it is raised; a change event is both a card in the feed and an entry in the domain's history. The account History ledger under the Alerts tab merges all of it, plus scans, credit spends and sign-ins, into one timeline.

Common questions

Can I get alerts by SMS or Slack? Not today. The Alerts feed and the push to the app are the two channels; the feed is readable over the API and MCP if you want to route it yourself.

Why did I get one push and not ten when a domain had ten findings? With the morning summary on, everything that can wait is folded into one push a day. With it off, findings are still grouped per domain per scan, and a change stays one event while it is open, with one alert per event.