Domain health scan

The domain health scan is the base scan on every plan. It reads what public DNS and the registry say about a domain and writes the result to the domain's DNS, Certificate and Email modules, the history ledger, and the three status cards.

Where to run it

Web: open the domain, then Check now. Or Overview, Check everything now.
iOS: the domain's page, Scan now beside the title. The progress arc runs on the domain's own last measured duration.
API/MCP: POST /api/domains/:id/scan, or the run_domain_scan tool (which also runs the security checkup and the single-page SEO).

Every scan counts against the website scan allowance: 6 a day on Free, 25 on Starter, 50 on Pro, 200 on Enterprise.

What it reads

Check	What is recorded
A and AAAA	Where the apex resolves
Nameservers	The NS set, the provider it belongs to (Cloudflare, Namecheap, GoDaddy and so on), and whether there is redundancy
DNSSEC	Read from two places: the DS record at the parent (the durable "is DNSSEC configured" signal) and whether the resolver validated the answer
MX	Where mail is delivered and which mail provider that is (Microsoft 365, Google Workspace, and others)
SPF, DKIM, DMARC	The published records, parsed. See SPF, DKIM and DMARC checks
Registrar (RDAP)	Registrar name, creation and expiry dates, status flags
Certificate	Issuer, expiry, chain, key and protocol versions, as our scanner read them from the server (daily, and again after Scan now). See Certificate monitoring

The result feeds the Domain status card: Healthy when everything resolved and nothing is due, Review for something to look at (a single nameserver, DNSSEC not configured), Action when a record is broken or the registration is close to lapsing.

Registration expiry notices

The expiry date comes from RDAP on each scan, so notices depend on the domain being scanned: nightly on paid plans, or whenever you press scan on Free. Notices fire at milestones so one lapse does not produce a nag every night:

Days left	Notice
About 30	First notice
About 14	Second
About 7	Third
1	Final

On Starter and up, the nightly re-scan raises each notice as an alert: it lands in the Alerts feed, titled "<domain> registration runs out in <n> days", as long as Domain registration renewal is on (Settings, Notifications on the web, or notify_expiry over the API; the app has no switch for it). With the morning summary on (the default) the push comes in the 8 a.m. summary rather than on its own. The app's on-device reminder (Registration expiring, with its own threshold) only runs when the morning summary is off; the server's alert always follows the milestones above.

DomainGuard does not renew the domain. Renewal happens at your registrar; the point of the notice is that it reaches you somewhere that does not depend on the expiring domain: the dashboard and your phone.

DNS issues and DNS changes

Two different things are reported:

DNS issues are findings from one scan: no nameservers, a broken SPF, an MX that does not resolve. They are findings on the domain page and, with Mail records (web) or DNS problems (app) on, an alert.
DNS changes are differences between two scans: an A record moved, the MX set changed, the nameservers changed. Those become change events with a lifecycle. See Change events.

Common questions

The scan says DNSSEC is not configured. Is that a failure? It is a Review item, not an Action. DNSSEC is worth turning on at your DNS host if it supports it, but its absence does not break anything today.

RDAP shows no expiry. Some registries do not publish it. The field shows a dash rather than a guess.

Can I scan a domain I do not own? This one, yes: it is a basic scan and only reads what the domain shows everyone. Deep scans, which probe the site, need the domain verified first. See Which domains you can scan.