Getting started
The domain setup guide
The per-domain checklist computed from what is actually set up: first check, alerts, email records, DMARC reports, ownership proof, monitoring and more.
Updated · 2 min read
Every domain carries a setup guide. It is computed on every read from the domain's real state: a scan that ran, a record that resolves, a proof that is current. Nothing in it is ticked by hand, and it folds away once the required steps are done.
Where
- Web: open a domain in the dashboard; the guide is the first card on its page.
- iOS: the card at the top of a domain's page. The first time this device opens a domain that still has essential setup left, the guide opens on its own.
- API/MCP:
GET /api/domains/:id/setup, or theget_domain_setup_guidetool.
The steps
| Step | Required | What "done" means |
|---|---|---|
| First check | Yes | A domain scan has completed |
| Alerts reach you | Yes | A notification channel exists that something reads: a device registered for push, or a notification email on a paid plan |
| Email authentication | Yes | SPF, DKIM and DMARC are published and pass. When one is missing the step carries the exact record to paste with a Copy button |
| DMARC reports | No | The rua= address DomainGuard hosts is in your DMARC record and reports are arriving. Blocked on Free; unlocked at Starter |
| Prove you own it | No | A current ownership proof exists on the account (DNS record, file, or an email link). Needed before any active scan |
| Watched every night | No | The domain is inside the plan's automated allowance. Blocked on Free once the three slots are used |
| Which business this is | No | The domain is filed under Personal or a Business client |
| Impostor check | No | A lookalike scan has run |
| Vulnerability scan | No | An exposure scan has completed |
| Keep scanning for exposure? | No | You answered yes or no to continuous exposure scanning |
Each step has a status: done, to do, running, blocked by plan (with the plan that unlocks it), skipped, or not applicable. Every step says why it matters and opens the screen that does it.
Skipping a step
Optional steps can be marked "not for this domain". That answer is stored on the domain and follows you between the app and the web. Required steps cannot be skipped. POST /api/domains/:id/setup/skip (or skip_domain_setup_step) records or clears a skip.
Progress
The guide reports done / total and required-done / required-total. A domain counts as set up when every required step is done, whatever the optional ones say.
Common questions
The guide says "Alerts reach you" is not done, but I get push. Push counts once the device has registered with the server after you allowed notifications. On Free, email alerts are not available, so the step is satisfied by a registered device.
Why is "Prove you own it" optional? Reading public records needs no proof. Proof is required only before active scanning (vulnerability scanners, port scans, whole-domain breach monitoring), and one proven domain clears the whole account. See Scan clearance.
Keep reading
Related articles
- DMARC reportsThe report address DomainGuard hosts for you, what aggregate reports reveal about who sends as your domain, the 30-day summary, rotation, and alerts.Email authentication ·Updated
- Scan clearance and ownership proofProve you control one domain on the account (DNS record, file, or an email link) and every domain is cleared for 90 days. Protected targets and authorisation.Vulnerabilities and exposure ·Updated
- Plans comparedEvery entitlement per plan: watched domains, cadence, email alerts, DMARC reports, crawl depth, Local SEO credits, lookalike watch, exposure scans, API, Ask.Plans and billing ·Updated