Push notifications and quiet hours

Push reaches the DomainGuard iOS app on every plan. The app registers its device token with the server after you allow notifications (POST /api/devices/register) and unregisters it when you sign out. Every push below is also a row in the Alerts feed, written the moment it is found, so an account with no iPhone still sees each one in the dashboard's Alerts page; there is no web push and no alert email.

One summary each morning (the default)

Since 2026-10-01 an account gets one push a day, around 8 a.m. Eastern, saying what is wrong across its domains. Between 8 a.m. and 5 p.m. Eastern only three things push on their own:

one of your sites stops answering (the uptime probe's down alert),
a vendor you use reports a real incident, and
a subdomain of yours points at a hosted service that is no longer set up, on a service where anyone can sign up and claim that name (a subdomain takeover). Someone could put their own page on your domain, so we don't hold it until morning.

Everything else waits for the next morning's summary: scan findings, vulnerabilities, change events, renewals, certificates, DMARC, lookalikes, breach hits, "back up", "fixed" and "resolved". A site going down at night is in the morning summary too. Nothing pushes after 5 p.m.

The switch is One summary each morning, under Settings, Notifications on the web and Account, Settings, Notifications in the app (notify_daily_summary, on by default). Turn it off and every alert below pushes as it is found, at the level shown in the table.

Who sends what

Notification	Sender	With the summary off
Vendor status incident	The status monitor: one push when an incident opens and one when it is resolved, only for subscribed vendors your domains actually run on (at most three vendor pushes in 15 minutes). Updates, minor incidents and incidents at other subscribed vendors are feed rows	Normal
Domain down / back up	The uptime probe; a site going up and down gets one notice	Normal
Dark web breach hit, password-stealing malware	The breach re-check cron	Normal
Scan finished (domain scan or vulnerability scan)	The scan pipeline, if `Scan finished` is on	Normal
"Did you make this change?" (Hijack Guard change event)	The change-event dispatcher (Starter and up)	Normal
New failing DMARC sender, `_dmarc` deleted or downgraded, alignment drop, recovery	The DMARC alert cron (Starter and up)	Normal
Lookalike alert	The lookalike alert dispatcher, once turned on (Starter and up)	Normal
Registration renewing or lapsing, certificate expiring, broken SPF, DKIM, DMARC or MX, security score under the threshold, new critical or high finding	The nightly re-scan (Starter and up)	Normal
New KEV or CVE match in software seen running on your domains (confirmed or possible)	The vulnerability feed ingest. A match for software that is only on your watchlist is a feed row with no push	Time-sensitive for a KEV entry, or a confirmed match scored CVSS 9 or higher; otherwise normal
A vulnerable version changed on a host: fixed, updated but still vulnerable, went backwards, no longer answering; WordPress found on a host	The software re-checks and nightly scan (paid plans)	Updated-but-still-vulnerable is time-sensitive on the same KEV / CVSS 9 rule; the rest normal
New subdomain, newly exposed admin or database service, a finding resolved, and the Monday still-vulnerable reminder	The nightly scan	Normal
Subdomain can be taken over	The daily subdomain pass (Starter and up), once per host per 30 days, under the `New subdomains` switch	Normal
Managed SPF record refreshed	The SPF refresh cron, for domains whose SPF DomainGuard manages	Normal

Notifications thread per domain and per provider, and carry actions: "Open domain" or "Open status". Tapping one deep-links to the right screen; a scan-finished push opens that domain's Vulnerabilities screen.

Notifications the app raises itself

Under Account, Settings, Notifications, "Pushed from this iPhone" holds three on-device reminders worked out from the data the app holds: Registration expiring, Site health drop (a health score under 50) and Email security (SPF, DKIM or DMARC misconfigured). They are switched off, and greyed out, while the morning summary is on, because the summary already carries them. With the summary off, Site health drop and Email security are time-sensitive and break through quiet hours.

Quiet hours

Silence non-critical, with a From and To time, holds this iPhone's own alerts and in-app banners until the window ends. Quiet hours are device-local: server-sent alerts are not delayed by it. A Focus mode that silences DomainGuard holds server pushes; a time-sensitive push (an urgent vulnerability, with the summary off) breaks through Focus modes that allow time-sensitive alerts.

Home Screen quick actions

Long-press the app icon for Add Domain, Scan All Domains and Service Status.

Common questions

Do I need the app for push? Yes. Push is APNs to the DomainGuard iOS app. The web dashboard does not send browser notifications.

Will anything wake me up at night? Not with the morning summary on: nothing pushes between 5 p.m. and 8 a.m. Eastern except the summary itself at 8. With it off, provider incidents, site-down and subdomain-takeover alerts are normal-level pushes that a Focus mode holds; only urgent vulnerability pushes are time-sensitive.

My pushes are not arriving. What do I check? First, whether the morning summary is on: most alerts then arrive only in the 8 a.m. push. Then work through Push notifications are not arriving: permission, device registration, the switch for that alert type, and Focus. Every alert is also in the Alerts feed meanwhile.