The domain setup guide

Every domain carries a setup guide. It is computed on every read from the domain's real state: a scan that ran, a record that resolves, a proof that is current. Nothing in it is ticked by hand, and it folds away once the required steps are done.

Where

Web: open a domain in the dashboard; the guide is the first card on its Overview tab.
iOS: the card at the top of a domain's page. The first time this device opens a domain that still has essential setup left, the guide opens on its own.
API/MCP: GET /api/domains/:id/setup, or the get_domain_setup_guide tool.

The steps

Step	Required	What "done" means
First check	Yes	A domain scan has completed
Alerts reach you	No	An iPhone with the DomainGuard app signed in has registered for push. Every alert is in the Alerts feed either way, so a web-only account can mark this step "not for this domain"
Email authentication	Yes	SPF, DKIM and DMARC are published and pass. When one is missing the step carries the exact record to paste with a Copy button. A domain that sends no mail can answer It doesn't send email instead
DMARC reports	No	The `rua=` address DomainGuard hosts is in your DMARC record and reports are arriving. Blocked on Free; unlocked at Starter
Prove you own it	No	The domain is your verified email's domain, has its own current proof (DNS record, file, or an email link), or the account is approved for deep scans of any domain. Until then basic checks run and the deep scans (open ports, known vulnerabilities, exposed files) wait
Watched every night	No	The domain gets the nightly scan and the uptime probe. Blocked on Free, where there is no nightly scan (Free's three watched domains get the uptime probe only). On a paid plan it shows "to do" when the domain is past the allowance or its automatic checks are paused
Say which business this is	No	A business name and city are saved for the domain, which local search checks need. Saving them is free; the ranking checks are Pro
Check for impostor domains	No	A lookalike scan has run
First exposure scan	No	An exposure scan has completed
Keep scanning for exposure	No	You answered yes or no to continuous exposure scanning

Each step has a status: done, to do, running, blocked by plan (with the plan that unlocks it), skipped, or not applicable. Every step says why it matters and opens the screen that does it.

Skipping a step

Optional steps can be marked "not for this domain". That answer is stored on the domain and follows you between the app and the web. Required steps cannot be skipped. POST /api/domains/:id/setup/skip (or skip_domain_setup_step) records or clears a skip.

Progress

The guide reports done / total and required-done / required-total. A domain counts as set up when every required step is done, whatever the optional ones say.

Common questions

The guide says "Alerts reach you" is not done, but I get push. Push counts once the device has registered with the server after you allowed notifications. If you never use the app, mark the step "not for this domain". You will still see every alert in the dashboard's Alerts page.

Why is "Prove you own it" optional? Because basic checks run without it. It turns on the deep scans (open ports, known vulnerabilities, exposed files) for that domain. Your verified email's domain, and every domain on an approved account, already counts; any other domain is verified on its own. See Which domains you can scan and Verifying a domain for deep scans.