Domains
Domain health scan
What the domain scan reads (DNS, nameservers, DNSSEC, the registrar record, expiry) and how the registration expiry notices are timed.
Updated · 3 min read
The domain health scan is the base scan on every plan. It reads what public DNS and the registry say about a domain and writes the result to the domain's DNS, Certificate and Email modules, the history ledger, and the three status cards.
Where to run it
- Web: open the domain, then Scan now. Or Overview, Scan all.
- iOS: the domain's page, Scan now beside the title. The progress arc runs on the domain's own last measured duration.
- API/MCP:
POST /api/domains/:id/scan, or therun_domain_scantool (which also runs the security checkup and the single-page SEO).
Every scan counts against the website scan allowance: 6 a day on Free, 25 on Starter, 50 on Pro, 200 on Enterprise.
What it reads
| Check | What is recorded |
|---|---|
| A and AAAA | Where the apex resolves |
| Nameservers | The NS set, the provider it belongs to (Cloudflare, Namecheap, GoDaddy and so on), and whether there is redundancy |
| DNSSEC | Read from two places: the DS record at the parent (the durable "is DNSSEC configured" signal) and whether the resolver validated the answer |
| MX | Where mail is delivered and which mail provider that is (Microsoft 365, Google Workspace, and others) |
| SPF, DKIM, DMARC | The published records, parsed. See SPF, DKIM and DMARC checks |
| Registrar (RDAP) | Registrar name, creation and expiry dates, status flags |
| Certificate | Issuer, expiry and chain, from certificate transparency. See Certificate monitoring |
The result feeds the Domain status card: Healthy when everything resolved and nothing is due, Review for something to look at (a single nameserver, DNSSEC not configured), Action when a record is broken or the registration is close to lapsing.
Registration expiry notices
The expiry date comes from RDAP on each scan. Notices fire at milestones so one lapse does not produce a nag every night:
| Days left | Notice |
|---|---|
| About 30 | First notice |
| About 14 | Second |
| About 7 | Third |
| 1 | Final |
A notice goes as a local notification on the phone and, on paid plans, by email when Registration expiry email is on. The subject reads "<domain> registration renews <date>". The default threshold in Settings is 30 days and can be changed under Notification settings.
DomainGuard does not renew the domain. Renewal happens at your registrar; the point of the notice is that it reaches an address and a device that are not on the expiring domain.
DNS issues and DNS changes
Two different things are reported:
- DNS issues are findings from one scan: no nameservers, a broken SPF, an MX that does not resolve. They are findings on the domain page and, with
DNS issueson, a notification. - DNS changes are differences between two scans: an A record moved, the MX set changed, the nameservers changed. Those become change events with a lifecycle. See Change events.
Common questions
The scan says DNSSEC is not configured. Is that a failure? It is a Review item, not an Action. DNSSEC is worth turning on at your DNS host if it supports it, but its absence does not break anything today.
RDAP shows no expiry. Some registries do not publish it. The field shows a dash rather than a guess.
Can I scan a domain I do not own? Yes. Reading public records needs no proof. Only active scanners (vulnerability, port, whole-domain breach monitoring) need scan clearance.
Keep reading
Related articles
- Scan clearance and ownership proofProve you control one domain on the account (DNS record, file, or an email link) and every domain is cleared for 90 days. Protected targets and authorisation.Vulnerabilities and exposure ·Updated
- Change events: "Did you make this change?"How DomainGuard detects DNS, nameserver, registrar and certificate changes, the question it asks, and the lifecycle each event goes through.Domains ·Updated
- Subdomain discovery and per-host resultsHow hosts under a domain are found (certificate logs and DNS), the 100-host limit, and what each host's page shows: status, certificate, ports and findings.Domains ·Updated