Watch every domain, or finish one job.
No tiers, no metering, no sales call.
The scan is free forever — it's how you find out what's wrong. Monitor keeps watching after the scan: it watches your domains and the names registered to look like them, and tells you the day something needs your attention.
- Full scan: SPF, DMARC, DKIM, MX, blacklist, domain & SSL expiry
- Copy-paste fix records, built and checked by code
- A plain-English report page per domain
Ongoing protection for every domain you run
- 10 domains, checked every day · 12-month history
- Emailed when a record breaks, something expires, a sender keeps failing or a lookalike turns high-risk
- The step-by-step path to p=reject, record included
One domain, taken step by step with you
- The exact record for each stage, backed by your own reports
- Your reports checked after every change, and word when the next step is safe
- Daily monitoring and alerts included for 90 days (lookalike watch is Monitor-only)
Plus tax where applicable.
| Capability | Scanner | Monitor | Package |
|---|---|---|---|
| Domains | Any, one scan at a time | 10 | 1 |
| How long | Forever | While subscribed | 90 days |
| Full scan and copy-paste fix records | Included | Included | Included |
| Checked again every day | Not included | Included | Included |
| Every new sender on your dashboard, emailed when one keeps sending unauthenticated mail | Not included | Included | Included |
| Alert when DMARC, SPF or MX changes or breaks | Not included | Included | Included |
| Warned before domain or SSL expiry, and when the registrar or nameservers change | Not included | Included | Included |
| Told when a mail server lands on a blacklist | Not included | Included | Included |
| Lookalike domains watched daily, scored, and emailed when one turns high risk | Not included | Included | Not included |
| The step-by-step path to p=reject, with the p=reject record | Not included | Included | Included |
| After a change: a six-location propagation check and a free 24-hour watch | Not included | Included | Included |
| Alerts and readiness in ChatGPT or Claude, with a linked account | Not included | Included | Included |
The trial shows when your domain is ready for p=reject; the p=reject step itself ships with the package or Monitor.
Agents can pay per call. Past the free per-caller rate limit our API answers HTTP 402 and takes $0.01 in USDC on base per call over the x402 protocol. The exceptions are the bulk endpoints and the watch tasks, which are priced per domain, per check, per report, per window or per day and have no free allowance; everything else stays free, and using DNS Doctor never needs a wallet.
The alerting in Monitor usually ships only in enterprise DMARC suites, expiry monitoring rarely ships anywhere, and lookalike watching is usually a separate, pricier add-on. Monitor covers all three, and that's deliberate, not a discount.
Do you ever change my DNS?
Never. We generate the record; you paste it yourself. Nothing is applied on your behalf, ever.
What happens when the trial ends?
Monitoring pauses and your history is retained in case you return. The free scanner keeps working — and no card was taken, so nothing is charged.
What counts as a domain?
One registered domain, subdomains included. The plan covers 10 of them — enough for an agency's client roster.
Can I cancel anytime?
Yes, self-serve from the billing portal. Refunds follow our 14-day policy — see Refunds below.
What if my domain can't reach p=reject?
Reaching it depends on your own senders, so nobody can promise it up front. The package ends at the highest policy your reports prove safe and names the sender that blocks the next step. You never get a stricter record than your reports support.
What happens after 90 days?
Monitoring stops and a closing mail says what was proven for your domain. Monitor is there if you want to keep watching — it is optional, and nothing renews on its own.
Billing is handled by Paddle, our merchant of record. See our terms, privacy policy and refund policy.