Alerts
Notification settings
Every alert switch, its default, the plan it needs, and what reads it. Every alert lands in the Alerts feed and is pushed to the iPhone app; there is no alert email.
Updated · 6 min read
A switch in DomainGuard exists only when something reads it. Each row below names the setting, the default, and the sender that consults it.
How an alert reaches you
Every alert does two things. It lands in the account's Alerts feed the moment it is found: the Alerts tab in the iOS app, and the Alerts page in the web dashboard, which shows an unread count. And it reaches every iPhone where the DomainGuard app is signed in to the account: by default as part of one summary push around 8 a.m. Eastern, with only a site going down or a vendor incident pushed on its own between 8 a.m. and 5 p.m. (see Push notifications and quiet hours). If you only use the web, nothing is pushed, but every alert is still in the feed.
Alerts are not sent by email or text message. The email DomainGuard sends is account mail: sign-up and password messages, support replies, and reports you ask for, such as the results of a scan you started.
Which alerts need which plan
- Every plan, Free included: a watched site going down and recovering, provider status incidents, dark web hits on a monitored address, new vulnerabilities (KEV and CVE matches) in software you track, and a scan you started finishing.
- Starter and up: everything the nightly re-scan raises (registration renewal, certificate expiry, broken or missing SPF, DKIM, DMARC or MX records, a low or falling security score, new critical or high findings, and change events that need an answer), DMARC alerts, and lookalike alerts from Lookalike Watch.
Where
- Web: Settings, Notifications (the Alerts group; the Scanning group sets the cadence).
- iOS: Account, Settings, Notifications. Each row's subtitle says when it fires. The app names some rows differently (Certificate expiring, DNS problems, Security issues); the table gives the web name.
- API/MCP:
GET/PUT /api/settings; toolsget_account_settings,update_account_settings(pass only the fields you want to change).
The switches
Every row below works on every plan unless it says Starter and up. The Starter rows come from the nightly re-scan, or from a module that starts at Starter. Names are as the web dashboard shows them, with the API field.
| Setting | Default | Fires when |
|---|---|---|
One summary each morning (notify_daily_summary) |
On | Holds every push except a site going down, a vendor incident and a subdomain someone else could claim (8 a.m. to 5 p.m. Eastern only) for one summary around 8 a.m. Eastern. Off: every alert pushes as it is found |
Domain registration renewal (notify_expiry) |
On | Milestones at about 30, 14 and 7 days and the day before the registration runs out (Starter and up) |
Certificate expiry (notify_ssl_expiry, notify_ssl_days) |
On, 14 days | A hand-renewed certificate is inside the threshold; auto-renewing issuers only at 1 day. Covers the site and every subdomain and TLS port the daily certificate sweep reads, one row per host (Starter and up) |
Mail records (notify_dns_issues) |
On | A scan finds a broken or missing SPF, DKIM, DMARC or MX record, at most once a week per domain (Starter and up). Also a "Fixed" note when a mail or DNS check that failed on the last two checkups passes |
Security (notify_security_issues, security_threshold) |
On, 60 | The checkup score falls under the threshold, a scan finds a new critical or high finding, an admin or database service (SSH, Remote Desktop, a UniFi controller, MySQL) starts answering on two scans in a row, or a security header that failed twice is fixed (Starter and up). Vulnerabilities in software you track alert on every plan: a push when a scan has seen the software running (confirmed or possible), a feed row without a push for watchlist-only matches, and a Monday reminder while any stay open |
Site speed (notify_site_speed) |
On | A scheduled site check finds a site has got slow on phones: main content over 4 seconds where it used to be quicker, or the speed score falling sharply. Starter checks weekly, Pro and Enterprise daily |
Domain changes (Hijack Guard) (notify_dns_record_changes) |
Off | A scan raises a change event that needs an answer (Starter and up). See Change events |
Website uptime (notify_uptime_push) |
On | A watched site goes down (two failed checks in a row) or is back up (two good checks in a row). A second outage within 24 hours gets one "going up and down" row instead of its own alert, and an outage that then lasts 30 minutes is alerted on its own (at most two down alerts per site in 24 hours) |
Third-party vendor status (notify_status_push) |
Off; the app's "Notify me about provider issues" is on by default and subscribes only to providers found in your records | A subscribed provider opens an incident (one push) and resolves it (one push, only if you were pushed the opening). Updates are feed rows, and the feed shows one row per incident. Only providers your domains run on push; the rest of your subscriptions are feed rows. At most three provider pushes in 15 minutes |
New subdomains (notify_new_subdomains) |
On | A host under one of your domains shows up for the first time in public certificate logs or DNS. The first discovery after a domain is added is its baseline and raises nothing. Also covers "Subdomain can be taken over" (Starter and up) |
Scan finished (notify_scan_complete, in the app) |
Off | A scan you started completes |
DMARC (notify_dmarc_alerts) |
On | A new unauthenticated sender, a deleted or downgraded _dmarc record, or a recovery (Starter and up, because it needs DMARC reports) |
| Lookalike alerts | Off until you turn them on with update_lookalike_alert_settings or the API (no switch on the web or in the app yet) |
A lookalike appears, gains mail or escalates (Starter and up). GET/PUT /api/settings/lookalike-alerts |
| Dark web hit (no switch) | Always on | A new breach or infostealer log lists a monitored address |
A managed SPF record that DomainGuard refreshes for you also posts a notice to the feed and the app when it changes.
Scan results by email
Email me scan results (notify_scan_results_email, off by default) emails the report of a scan you started to your sign-in address. It is a copy of something you asked for, not an alert.
Scan cadence
scan_frequency (daily by default; every3days or weekly; hourly on Enterprise once you switch it on) lives in the same settings object. See Scan settings and cadence.
Common questions
I turned everything on and get nothing. With the morning summary on, most alerts arrive only in the 8 a.m. push; check the Alerts feed. Then check that the app has notification permission (Account, Settings, Notifications says so at the top when iOS has notifications off) and that you are signed in on the iPhone. If you only use the web, alerts are in the Alerts page and are not pushed anywhere. See Push notifications are not arriving.
Can I mute one domain? On the web, Mute findings for 30 days in the domain's ⋯ menu, or Pause monitoring to stop its automatic checks altogether; a paused domain raises nothing. In the app, pause it from the domain's ⋯ menu.
Keep reading
Related articles
- The alerts feedHow alerts are listed, what Open and Read mean, swipe to Read or Mute 7 d, the alert detail page, and the account History ledger.Alerts ·Updated
- KEV and CVE alerts with verdictsHow the CISA KEV and NVD feeds are ingested, why only new entries alert (watch-forward), the four exposure verdicts, the advisory page, and the global feed.Vulnerabilities and exposure ·Updated
- Plans comparedEvery entitlement per plan: watched domains, cadence, alerts, DMARC reports, crawl depth, Local SEO credits, lookalike watch, exposure scans, API, Ask.Plans and billing ·Updated