Help center

Troubleshooting

The messages you are most likely to meet and what each means: needs an account, ownership proof, over the allowance, scan limits, 401 and 402, missing push.

Updated · 8 articles

Most "errors" in DomainGuard are the server saying exactly what it needs. This category collects the messages, what each means, and the shortest fix.

Articles

When it is not one of these

Use Help in the web dashboard's side rail (its Ask for help form, also offered when a scan fails), or Ask NHM or Email under Account, Support in the app. The web form carries the section, the domain, your plan and any scan or error id, so the reply can be specific. Operational failures are recorded on our side with the same ids; quoting one gets you to the answer fastest.

The pattern behind most of them

Three kinds of refusal cover nearly every message in the product:

  1. A gate. The action needs a session, a plan, a scope, or proof of ownership. The message names which, and the API returns 401, 402 or 403 with the reason. Nothing is broken; something is required.
  2. An allowance. The action is metered and the window has not reset. The message names the reset time, and the API returns 429 with Retry-After. Existing results stay readable.
  3. A measurement. The product is reporting something you did not expect: a certificate from the logs rather than the host, a lookalike that scored benign, a domain that reads "on demand". The article explains what was measured and why.

If a message fits none of those, it is probably a bug, and the ids attached to the web Ask for help form are how it gets found.

Where the record is

The alert feed is the record of what you were told and how it was delivered. History (Alerts tab, or GET /api/notifications/activity) is the ledger of everything the account did. A domain's History module in the app shows every scan. When something looks wrong, those three views answer "what actually happened" before anyone guesses.

In reading order

Articles in Troubleshooting

  1. "Needs an account" and "Ownership proof needed"The two gates on scanning: a session for any server-side check, and, for deep scans only, a verified domain (an email link, a DNS record or a file, or your work email's domain). What each message means and the fix.Updated
  2. No DMARC reports are arrivingWhy a DMARC setup can look finished and receive nothing: the rua= address, the record location, a provider wizard, the 48-hour wait, and what to check in order.Updated
  3. A domain says "on demand" or "past your plan limit"What happens to a domain over the plan's automated allowance: it stays, it scans when you ask, it accepts edits, and the oldest domains keep the automation.Updated
  4. Scan limit reachedEvery manual scan is metered per plan: the allowances for website, vulnerability, network and dark web scans and accessibility audits, and the reset message.Updated
  5. API and MCP: 401, 402, 403, 429, or a missing toolWhat each response means when a key or an MCP client is refused, and the one fix that usually applies: mint a key with the right scope on the right plan.Updated
  6. Push notifications are not arrivingThe checklist for missing push: permission, device registration, the switch for that alert type, the morning summary, quiet hours, Focus modes, and what to tell support.Updated
  7. The certificate reading looks wrongWhy the certificate module can disagree with your host: when it was last read, Cloudflare's edge certificate, the app's own handshake, auto-renewing issuers, and subdomain and port certificates.Updated
  8. The lookalike check found nothingWhat an empty result means, why it always comes with a coverage count, how to widen the check, and when a known impostor does not show up.Updated

Still stuck?

Ask the people who run the scanner.

Send the domain and what you expected to see. We look at the same scan you are looking at and write back with what it means and what to change.

Contact supportCall (330) 305-2750