DomainGuard for MSPs
You know the tenant is watched. Proving it is a different job, and it usually turns into an afternoon of screenshots. DomainGuard keeps the record while the monitoring runs: expiry, certificates, DNS changes, uptime windows, open ports and CVE exposure, per tenant, with dates on everything.
The iPhone app is not on the App Store yet. The web dashboard is live, and the free plan needs no card.
Evidence, not assertion
The gap at a quarterly review is rarely the work. It is that the work left no artifact, so the answer has to be a sentence beginning with “we monitor for that”.
| What they ask | What you open |
|---|---|
| Is every domain we own being watched? | The domain list, with the last scan time on each one. Every plan holds unlimited domains, so nothing is left out for being over a cap. |
| Did anything change without us knowing? | The DNS diff and the domain-event feed: nameserver, registrar, certificate and hosting changes, each with a timestamp and a severity. |
| Were we down last quarter? | Uptime snapshots and recorded downtime windows, including the ones nobody was awake for. |
| Are we exposed to anything in the news? | KEV and CVE alerts carrying a verdict — confirmed, possible, not affected or unconfirmed — derived from that tenant's own scan evidence rather than a product name match. |
| Can our email be spoofed? | SPF, DKIM and the published DMARC policy per domain, with aggregate report data on Starter and up. |
| What did you actually do about it? | The activity feed and the compliance tracker, which turns PCI, HIPAA and cyber-insurance requirements into items with a status. |
How it scales across tenants
Adding a domain is never refused, on any plan, including the free one. What a plan sells is attention: how many domains are re-checked without anyone asking, and how often.
Including free. What a plan buys is how many are watched without being asked: three on Free, 25 on Starter, 100 on Pro, no limit on Enterprise. A domain over the automation cap still scans on demand and still accepts edits, and the oldest domains keep the automation.
Free runs every module the moment you ask for it, and keeps a five-minute uptime probe on three domains. The nightly re-scan starts at Starter. Enterprise can switch it to hourly in Settings, and its domains go first in each scheduled sweep.
API keys carry resource scopes — domains, scans, seo, vulnscan, compliance, status, accessibility — plus an optional write scope on Enterprise. Keys are rate limited per hour, and the plan is re-read on every request, so a downgrade drops write access on the next call rather than at the next renewal.
The part almost nobody else has
DomainGuard runs an MCP server at /api/mcp over Streamable HTTP. An API key is the bearer token, the tool list is filtered to that key's scopes, and the plan is checked on every call. Pro gets the read tools; Enterprise adds the ones that change state.
Questions worth asking on a Monday
This is the piece that changes the reporting job. Quarterly summaries, exception lists and “which tenants need a call this week” all become questions rather than exports, and the answer is built from the account's own records rather than from a model's guess.
Mint one key per use and give it only the scopes it needs. Tools outside a key's scopes are never offered and cannot be called.
Read the full MCP referenceWhat it is not
DomainGuard sits next to the stack you already run rather than replacing a piece of it.
There is no agent, nothing installed on an endpoint, and no patch deployment. DomainGuard watches the outside of a tenant: the domain, the DNS, the certificate, the mail authentication, the exposed services and the site itself.
No DNS edits, no registrar actions, no site changes. Enterprise write access reaches the account's own data — starting a scan, spending a credit, updating a saved record — and nothing outside it.
Port scanning and the aggressive vulnerability scanners run only on domains where the account has proved control, by DNS record, a file, an email link, or a verified sign-in address at the domain. Proof lasts 90 days and is per domain, not per account. An MSP can ask us to approve the account for deep scans of all its tenants' domains.
The ownership gate is worth defending rather than apologizing for. An unauthenticated port scanner aimed at arbitrary third parties is how a platform account gets terminated, and every tenant on it goes with it. Proving control is what keeps the scanner available at all.
What it costs
Put every tenant domain in on the free plan and run the checks yourself, with no card. Automation, alerts and the reporting surface start at $6.99 a month.
Every health check on every domain you own, whenever you run it
$0/mo
No credit card. Nothing expires.
Add as many domains as you own
3 checked for downtime every 5 minutes. Everything else runs when you press scan.
Includes
DMARC reports, SEO and accessibility, Lookalike Watch, and 25 domains re-checked for you every day
$6.99/mo
Billed monthly. Or $69.99 a year. Cancel any time.
Add as many domains as you own
25 fully re-checked for you every day, plus a downtime check every 5 minutes.
Everything in Free, plus
The local SEO suite, daily SEO scans and reports, read-only API and MCP access, and 100 domains re-checked for you every day
$49.99/mo
Billed monthly. Or $499.99 a year. Cancel any time.
Add as many domains as you own
100 fully re-checked for you every day, plus a downtime check every 5 minutes.
Everything in Starter, plus
Every domain in the account re-checked for you, hourly if you switch it on, and an API and MCP server that can make changes
$99.99/mo
Billed monthly. Or $999.99 a year. Cancel any time.
Add as many domains as you own
All of them fully re-checked for you every day, or every hour if you turn it on, plus a downtime check every 5 minutes.
Everything in Pro, plus
Prices in USD. Paid plans are bought in the DomainGuard iPhone app through Apple, which works out any sales tax and sends the receipt. Cancel any time in your iPhone's Settings, under Subscriptions.
Plans are sold through Apple in-app purchase. DomainGuard is pre-revenue. The iPhone app is not on the App Store yet.
Before you roll it out
One account holds every domain. You sort them into groups you name, one per client if you like, and the dashboard and the app filter by group. There is no per-tenant login handoff today. If a client wants their own account they create one and add their own domains, and the two accounts are independent.
By re-asking the question against evidence. A KEV or NVD entry that name-matches something on the watchlist is only a catalogue match. DomainGuard then checks it against what scans actually observed on that account — scanner findings citing the CVE, components seen running with a version, service banners from open ports, and the published affected-version ranges — and labels the alert confirmed, possible, not affected, or unconfirmed. Unconfirmed means we have never observed the product, not that you are safe, and the interface says so in those words.
Yes, two ways. Pro includes read-only API keys and the MCP server, so an assistant or a script can read the account. Enterprise adds the write scope. PDF reports start at Starter if you would rather hand over a document than build one.
Remove the domain. Nothing is deleted implicitly, and going over an automation cap never makes a domain read-only or drops it from the list — the oldest domains keep the automation and the rest scan on demand.
Every health module, on every domain, run whenever you ask: DNS and registrar records, SSL, SPF, DKIM and the DMARC record, uptime, blacklists, security headers, the website scan, the vulnerability scanner, tech detection and the compliance tracker. Free also keeps the five-minute uptime probe on three domains, one monitored address for dark-web exposure, and KEV/CVE alerts. Automation beyond that starts at $6.99 a month.
Start with one tenant
The free plan needs no card and does not expire. The iPhone app is not on the App Store yet. It uses the same account as the web dashboard.
