Notification settings

A switch in DomainGuard exists only when something reads it. Each row below names the setting, the default, and the sender that consults it.

Where

Web: Settings, Alerts and channels. The notification email address is set here.
iOS: Account, Notifications. Each row's subtitle says when it fires.
API/MCP: GET/PUT /api/settings; tools get_account_settings, update_account_settings (pass only the fields you want to change).

Push (every plan)

Setting	Default	Fires when
Registration expiry (`notify_expiry`, `notify_expiry_days`)	On, 30 days	The registrar's expiry date is inside the threshold; milestones at 30, 14, 7 and 1 days
SSL expiry (`notify_ssl_expiry`, `notify_ssl_days`)	On, 14 days	A hand-renewed certificate is inside the threshold; auto-renewing issuers only at 1 day
DNS issues (`notify_dns_issues`)	On	A scan finds a broken or missing record. Breaks through quiet hours
Security issues (`notify_security_issues`, `security_threshold`)	On, 60	The checkup score falls under the threshold; email authentication misconfigured
Site health drop	On	A watched domain's health score falls under 50. Breaks through quiet hours
DNS record changes (`notify_dns_record_changes`)	Off	A record differs from the last scan (change events)
Blocklist (`notify_blacklist`)	On	The site's IP appears on a DNS blocklist
Uptime (`notify_uptime_push`)	On	A watched site goes down or recovers. Time-sensitive
Provider status (`notify_status_push`)	Off; the app's "Notify me about provider issues" is on by default and subscribes only to providers found in your records	A subscribed provider opens or resolves an incident
Scan finished (`notify_scan_complete`)	Off	A scan you started completes
DMARC alerts (`notify_dmarc_alerts`)	On	A new unauthenticated sender, a deleted or downgraded `_dmarc` record, or a recovery (Starter and up)
Lookalike alerts	Set under Settings, Lookalike alerts	A lookalike appears, gains mail or escalates (Starter and up). `GET/PUT /api/settings/lookalike-alerts`
Dark web hit	On	A new breach lists a monitored address

Email (Starter and higher)

Each of the push rows above has an email twin (notify_expiry_email, notify_dns_issues_email, notify_security_issues_email, notify_ssl_expiry_email, notify_dns_record_email, notify_blacklist_email, notify_status_changes_email, notify_uptime_email), all off by default, and notify_dmarc_alerts_email, which is on by default, plus:

Setting	Default	What it sends
Weekly summary (`notify_weekly_summary_email`)	On on paid plans	A portfolio summary read off the latest stored results, deduplicated to once every seven days
Scan results by email (`notify_scan_results_email`)	Off	The results of each scan
Dark web email alerts	Off	New breach hits by email; set under Exposure, Email alerts (`/api/darkweb/delivery`)

Emails go to the notification email on the account, which should be an address off the domains being watched. That is the point: the renewal notice for an expiring domain should not land in a mailbox on the expiring domain.

Free accounts get push only. The email_alerts capability starts at Starter.

Scan cadence

scan_frequency (daily, every3days, weekly, hourly on Enterprise) lives in the same settings object. See Scan settings and cadence.

Common questions

I turned everything on and get nothing. Check that the app has notification permission and that a device is registered (Account, Notifications shows a test button). On the web, check the notification email is set and verified. See Push notifications are not arriving.

Can I mute one domain? Turn scanning off for that domain under its Scan settings; a domain that is not scanned raises nothing.