Every domain you own,
watched by one intelligent layer.
SSL, DNS, WHOIS, DMARC, blacklists, security headers — one platform, one alert stream, one AI fix.
Purpose-built for teams that own more than one domain.
Domains break silently. You find out from customers.
DomainScan Platform is one watch layer across everything a domain can go wrong at — SSL certificate expiry, DNS record drift, WHOIS hijacks, DMARC misconfiguration, blacklist listings, missing security headers, lookalike domains. Every alert ships with an AI-generated, paste-ready fix tailored to your DNS provider and registrar. If you already stitch together TrackSSL, EasyDMARC, UptimeRobot SSL, and MXToolbox — this replaces all four.
Eight capabilities. One bundle. One alert stream.
Every capability runs on the same shared probe substrate — one TLS handshake, one WHOIS query, one authoritative DNS resolution per domain — so cost stays flat as your portfolio grows from 1 to 1,000 domains. Cadence auto-escalates near deadlines (SSL expiring in 3 days? We recheck hourly). Full engine details in our learning hub.
Certificate lifecycle
Warn at 30 / 14 / 7 / 3 / 1 days. Detect unexpected rotations. Validate the whole chain — not just the leaf.
- ✓ Expiry countdowns
- ✓ Rotation classification
- ✓ Chain + SAN validation
- ✓ Auto-renew coverage
Registrar-agnostic renewal watch
Miss the registrar reminder in spam? We won't. Auto-renew failure inference and TLD-aware grace-period countdown.
- ✓ 90 / 60 / 30 / 14 / 7 / 3 / 1d thresholds
- ✓ Auto-renew miss detection
- ✓ Grace-period timeline
- ✓ Deep-link to renew
Every record, continuous diff
Someone added a verify TXT? Someone deleted your MX? You know within the hour, with an AI verdict on intent.
- ✓ A · AAAA · MX · TXT · NS · CNAME · CAA · SRV · SOA
- ✓ Dangling CNAME takeover detection
- ✓ Per-record severity
- ✓ Maintenance windows
Registrant + hijack correlator
Registrar swap + NS change + transfer-lock removal within hours = hijack pattern. We correlate DNS + WHOIS in one timeline.
- ✓ Field-level changelog
- ✓ Lock-status tracking
- ✓ Combined DNS + WHOIS timeline
- ✓ Hijack-pattern alert
p=none → p=reject, coached
The static checker is table stakes. The 5-stage enforcement journey with readiness gates is the moat.
- ✓ RUA report ingestion
- ✓ SPF 10-lookup analyzer
- ✓ DKIM key age audit
- ✓ Stage-by-stage advance gates
RBL + reputation, watched
~130 blacklists + Google Safe Browsing + PhishTank. Delisting requests auto-repolled hourly.
- ✓ Mail-IP auto-discovery from DMARC
- ✓ Delisting workflow
- ✓ Safe Browsing + PhishTank
- ✓ AI cause analysis
HSTS, CSP, and the rest
Grade your site's HTTP security posture. Alert when a header regresses in a deploy.
- ✓ A+ → F grading
- ✓ Header regression alerts
- ✓ CSP diff view
- ✓ Best-practice callouts
Lookalike domains, surfaced
Homoglyphs, TLD swaps, brand+login combos. We surface, you decide. Not takedown — awareness that's honest about scope.
- ✓ 500 permutations per domain
- ✓ Screenshot side-by-side
- ✓ AI verdict per finding
- ✓ One-click report to Safe Browsing
From nothing to actively watched, in 90 seconds.
Not "what's wrong".
Here's the exact fix.
Prism knows your stack — your DNS provider, your registrar, your cert CA, your mail provider, your CDN — because we already probe for it. Every alert ships with a paste-ready remediation tailored to your stack, not a generic knowledge-base article.
- ◆ Risk-tagged:
safe·caution·destructive - ◆ Provider tabs — Cloudflare, Route53, GoDaddy, generic
- ◆ Copyable DNS records + CLI commands, one-click
- ◆ Lazy generation + 7-day cache — no wasted tokens
p=none. Move to p=quarantine pct=10 to start collecting enforcement signal.
_dmarc TXT record.v=DMARC1; p=quarantine; pct=10; rua=mailto:[email protected]; adkim=r; aspf=r;
/platform/dmarc/acme.io/reports._dmarc TXT record, replace value:"v=DMARC1; p=quarantine; pct=10; rua=mailto:[email protected]; adkim=r; aspf=r;"
_dmarc → Edit → paste:v=DMARC1; p=quarantine; pct=10; rua=mailto:[email protected]
_dmarc.acme.io:v=DMARC1; p=quarantine; pct=10; rua=mailto:[email protected]
The features that make this a platform, not a tool.
A five-stage journey, gated by real readiness.
Competitors show you a dashboard. We show you the path — with gates. You can't advance to p=quarantine until the readiness criteria pass: seven days of RUA data, sub-5% unknown senders, 95% pass rate for known senders. Move too fast, break your mail. We won't let you.
- ✓ ≥7 days of RUA data
- ✓ <5% unknown senders (2%)
- ✗ ≥95% pass on known senders (91% · 3 senders below)
Every domain compromise leaves the same footprint.
Registrar swap. NS records change. Transfer-lock removed. All within 18 hours. Three separate events at three separate tools — or one WHOIS_LIKELY_HIJACK alert at ours, pinned red, with the whole attack chain in one timeline.
Most monitors check the leaf. We probe the whole chain.
Missing intermediate, expired intermediate, weak signature algorithm, wrong SAN set — every failure mode surfaced with its exact position in the chain. Because when a cert breaks, it's rarely the leaf.
One bundle replaces four point tools.
What you'd stitch together today across TrackSSL + EasyDMARC + UptimeRobot + MXToolbox — plus the DNS drift and hijack detection none of them offer — in one platform, one bill, one dashboard. See detailed side-by-side comparisons with every major domain-monitoring vendor.
| Capability | ✻ DomainScan | TrackSSL | EasyDMARC | UptimeRobot | MXToolbox |
|---|---|---|---|---|---|
| SSL expiry + rotation | ✓ | ✓ | × | basic | basic |
| DNS drift + AI verdict | ✓ | × | × | × | × |
| DMARC enforcement journey | ✓ | × | partial | × | × |
| WHOIS hijack correlator | ✓ | × | × | × | × |
| Blacklist + delisting flow | ✓ | × | × | × | ✓ |
| AI-generated paste-ready fix | ✓ Prism | × | × | × | × |
| One bundle, one bill | ✓ | × | × | × | × |
| Agency / white-label | ✓ | × | ✓ | × | ✓ |
Priced for teams that own more than one domain.
Every plan includes the whole bundle — SSL, DNS, WHOIS, DMARC, blacklist, security headers, typosquat. Cadence and channels scale up. AI fix quota scales up. Agency layer unlocks white-label + multi-client.
- ✓ 5 domains
- ✓ Daily cadence
- ✓ Email alerts
- ✓ 100 AI fixes / month
- ✓ 15 domains
- ✓ Hourly on critical
- ✓ Email + Slack + Webhook
- ✓ 500 AI fixes / month
- ✓ DMARC RUA ingestion
- ✓ Custom thresholds
- ✓ 50 domains
- ✓ All channels + PagerDuty
- ✓ Escalation policies
- ✓ 3,000 AI fixes / month
- ✓ Audit log 365d
- ✓ DMARC RUF ingestion
- ✓ 200+ domains (blocks of 50/100/250/500)
- ✓ Multi-client workspaces
- ✓ White-label reports
- ✓ Per-client viewer access
- ✓ Custom monitor templates
- ✓ Audit-ready compliance reports
Grade any domain in 10 seconds.
Public shareable link. Full transparency on methodology. Fair letter grades, no vanity inflation. Then decide if you want us to keep watching it.
Grade a domain →Frequently asked questions about DomainScan Platform
Do you edit our DNS? +
Do you take down typosquat / lookalike domains? +
How do you avoid alert fatigue? +
What about multi-instance / high-availability? +
Data retention? +
Can I bring my own AI key? +
Built for the people who catch the outage first.
You own five domains: your main site, your app, your marketing subdomain, a legacy redirect, and the one you registered for a side project. You need something that tells you when SSL is about to expire or DMARC starts failing, without setting up five different tools. Free + Starter ($5/mo) covers you.
You've hit Gmail's Feb-2024 sender rules. You need DMARC at p=reject, no exceptions. You need to know the moment your primary or CDN cert rotates unexpectedly. Pro ($18/mo) unlocks per-monitor routing, DMARC RUA ingestion, and custom alert thresholds.
You manage 60 client domains. You need a branded monthly report per client, per-client access scopes for their internal team, and pricing that isn't "call for a quote". Agency ($179/mo) starts at 200 domains and stacks in blocks up to 500 more.
You want authoritative-DNS drift monitoring (not resolver-side), a hijack-pattern correlator that joins WHOIS with DNS in one timeline, and webhooks that don't rot silently. Pro or Business ($82/mo) — depending on channel needs.
Understand what we monitor.
Every capability on this page is backed by a plain-English article in the learning hub — no vendor-speak, no dark patterns, just what the record does and how it breaks.
Your first domain is free. Forever.
Add one. See how much we catch. Add more when you're convinced.
Cancel any time — we won't ask why.