What’s new in DomainWarn

Glossary

Around 40 terms from domain, email and website security have their own page at domainwarn.com/glossary: what the term means, how it works, why a mistake is dangerous, how to avoid it and which DomainWarn check finds it – with matching tools, guides and documentation pages. The A–Z overview is searchable.

Terms in findings

Technical terms in findings and incidents in the dashboard are underlined: hover over one for a short explanation, click it to open the glossary page in your language. Below, all terms for the finding are listed in one line.

Email security quick check based on BSI TR-03108 / TR-03182

A new free tool checks a domain with criteria based on the BSI technical guidelines for secure email transport and email authentication: STARTTLS and TLS on the mail server, DNSSEC, DANE, TLS-RPT, SPF, DKIM and DMARC. For each criterion you see its identifier and level (MUST or SHOULD), whether it is met, partly met, not met or not checkable, with a reason and a recommendation; the summary at the top reads like “11 of 14 met”. An automated test from the outside, not a certification.

NIS2 quick check

A second new tool maps the points of a domain that can be checked from the outside to the measures under Art. 21(2) NIS2: encryption and HSTS of the website, DNSSEC and CAA, name servers, domain expiry, security.txt and the protection of email. What only continuous monitoring can evidence – availability over 30 days, open ports – shows as “only with monitoring” instead of being guessed. There is no certificate for NIS2; the check only covers the measures visible from the outside.

Seal & banner

Show on your website that your domains are monitored with DomainWarn: under Settings › Organization › Seal & banner you create a seal with your company name and the DomainWarn logo – as a small seal, banner, leaderboard or square, light or dark, in English or German, with a live preview, an HTML snippet and a download as SVG or PNG. You decide what the seal shows: company name on or off (optionally with a name of your own), number of monitored domains and check date. A click leads to a confirmation page with name, logo, “customer since” and the last check; if the seal is switched off or no longer in your plan, it shows “no longer valid”. From Freelancer.

Check report and “Email security checked” seal

You can now create a dated email security check report for every domain: a unique report number, the check date, the result “External email security check – 13 of 14 criteria met” and all criteria from BSI TR-03108 and TR-03182 with their result, as a PDF with QR code and as a verification page that shows the state at the time of the check. On top, there is the seal “Email security checked · Criteria based on BSI TR-03108” for your website: DomainWarn checks the chosen domain daily, and the seal is only valid as long as all counted criteria are met – otherwise it shows “no longer valid”. An automated check from outside, not a certification by the BSI. From Freelancer.

Seals for customer domains

As an agency you can issue a dedicated “Email security checked” seal for each of your customers’ domains for them to embed on their website – with the customer as holder, its own verification page and the same daily check. Customer logins can copy the code themselves. DomainWarn keeps check reports for 13 months.

Partner programme and marketing material

If you recommend DomainWarn, you can become a partner: partners are listed with logo, description and link on the new “Partners” page, their seal says “Partner of DomainWarn” with its own badge and is valid regardless of the plan. Listed are those whose website shows the seal – DomainWarn checks this daily. “Partner material” offers logos, ad banners in five formats, screenshots of the dashboard and copy in English and German, one by one or as a ZIP; the seal page in the dashboard links to it.

Incidents on the domain

Every domain has its own “Incidents” tab with all open and resolved incidents, filterable by status and severity, with cause, acknowledging and report. The number of open incidents sits on the tab, the overview names the most recently resolved one from the last 30 days when none is open, and the incidents page filters by domain.

Notifications in the dashboard

The bell at the top of the dashboard collects what concerns you: features unlocked in addition, accepted invitations, failed payments, a used-up SMS quota, channels switched off after errors and finished or failed domain imports. A click takes you to the place in question; everyone has their own entries and marks them as read one by one or all at once. “All notifications” lists every entry on a page of its own, unread ones only if you like.

Search across the whole dashboard

The search field at the top now finds not only domains but also clients, incidents, events, invoices and members – in the area you pick or everywhere, grouped by area. / or Ctrl+K (⌘K) opens it, arrow keys and Enter pick a result.

Free plan for new accounts

New accounts monitor one domain on the Free plan after the 14-day trial, with the same scope otherwise. If you signed up before, you keep three domains on Free for good – nothing changes for you. More domains come with a plan from €19 per month.

New plan line-up with grandfathering

Screenshots, the privacy check, accessibility and white-label – reports and client emails in your own design, “hide DomainWarn” – are now only available on the Agency Pro plan for new use. If you already used one of these features on your plan, you keep it for good (grandfathering). Billing › Plan now shows “Additionally unlocked for you” with everything you get beyond your plan, including the date and grandfathering. The trial includes everything from Agency Pro – features and limits, single sign-on too.

Screenshots without cookie banners

DomainWarn now accepts cookie banners before capturing and waits until images have loaded and animations have finished – the screenshot shows the page the way visitors see it. The “Screenshots” page shows the selected change large in the middle, with reference screenshots and history to the right, and a click opens an image in a dialog instead of a new tab.

Subdomain inventory per domain

You now switch the subdomain inventory on per domain under Settings › Monitoring; new domains start without it, so that leftovers on forgotten subdomains are not all reported at once.

Paused domains

A paused domain shows “Paused” next to its name, and “Resume” sits on the right with the other actions. While it is paused, DomainWarn does not check it on demand either.

Sortable tables

A click on the column header sorts domains, clients, expirations, timeline, delivery log, members, API tokens and connected apps, a second one reverses the order. The sorting stays in the link and when you go back, the CSV export of expirations follows it, and you order incidents by urgency, newest or oldest first. Names sort alphabetically, upper and lower case together, umlauts with their base letter. Via the API you sort with sort and direction.

Invoices on a page of their own

Settings › Billing › Invoices lists all invoices with number, period, net, tax, gross and status, sortable. A click opens the invoice as a PDF right in the browser.

Live indicator with a reason

After an interruption the dashboard reconnects right away and loads what has changed in the meantime. If there is no live connection, the “Live” dot names the reason, and while monitoring is paused it says that nothing is coming in.

The MTA-STS and BIMI addresses hosted by DomainWarn (mta-sts.your-domain.com, bimi.your-domain.com) now redirect requests over http:// to HTTPS and send HSTS. Until now they only returned “404 page not found”.

In the English dashboard and in the domain check on the English website, severities now appear in English; until now every finding said “Kritisch” or “Warnung”.

Buttons and highlights in brand blue are easier to read on the website and in the dashboard: the white text lacked contrast and now meets WCAG 2.2 AA, on hover too. The language switcher now also tells screen readers the language shown.

Accessibility checks

A new free tool and a daily monitor test pages for barriers against WCAG 2.2 AA, the basis of the European Accessibility Act. Missing alt text, weak contrast and unlabelled buttons show up with an example and guidance; new serious barriers are reported right away. Switch the monitor on per domain (from Freelancer).

Screenshots

DomainWarn captures your page every hour in a real browser and compares it with a reference screenshot. Defaced pages (“hacked by”), replaced content and unwanted changes are reported with before, after and highlighted differences; intended changes are accepted with one click. From the Agency plan, in the Website tab.

Subdomain inventory

DomainWarn now checks every known host name of your domain daily – from the website monitors, the zone at your DNS provider and the Certificate Transparency logs –, not just the domain and www: is the certificate valid and issued for this name, is HSTS set, does HTTP redirect to HTTPS? An expired or wrong certificate, such as the default certificate of a proxy, is reported as a warning, missing HSTS and a missing redirect as a hint. The table of all hosts is in the “Website” tab. Host names without a DNS record are left out, mail hosts are only checked for their certificate.

Single sign-on

On the Agency Pro plan your team signs in through your identity provider – Entra ID, Google Workspace, Okta, Keycloak, Authentik and any other with OpenID Connect. You prove your email domains with a DNS record, new members join the team on their first sign-in, and if you like, SSO becomes the only way in. A test sign-in shows what your provider sends before you switch it on. You find it under Settings › Organization › Single sign-on.

Mail test

Send a mail to a one-time address and see right away whether SPF, DKIM and DMARC pass, whether reverse DNS and encryption are right and whether the server is on a blacklist – with a score and recommendations. Free under Tools and per domain under Email › Mail test.

Compliance report for NIS2 and BSI TR-03108

From the Agency plan, DomainWarn shows per domain and per customer which requirements for secure email transport (BSI TR-03108), email authentication (BSI TR-03182) and the NIS2 measures are met – with evidence, recommendations and a PDF in your own design. Parked domains that send no email are checked too, so they cannot be used to spoof senders. A technical indication from the outside, not a certification.

Connect ChatGPT and Claude.ai with a click

DomainWarn can now be added as a connector in ChatGPT and Claude.ai without a token: enter the address https://api.domainwarn.com/mcp, sign in to DomainWarn, pick the organization and decide whether the assistant may make changes. Settings › API lists all connected apps, and you disconnect them with a click.

Tickets in HaloPSA, Autotask and ConnectWise PSA (Beta)

From the Agency plan, DomainWarn opens a ticket in your PSA system for every incident, at the client the domain belongs to. Escalations and reminders are added as internal notes, and once the incident is resolved the ticket is closed. You choose ticket fields such as board, status and priority per severity. The integrations are still in Beta.

NinjaOne (Beta)

From the Agency plan you connect DomainWarn to NinjaOne: incidents become tickets at your client’s organization, you import NinjaOne organizations as clients or create your clients there, and the state of all of a client’s domains appears as a table right in their organization. You switch on each part separately.

Record click paths with the mouse

Instead of writing selectors, you now click through an image of your page: DomainWarn outlines buttons, links and fields, a click turns one into a step, and after each step the browser replays the path. Checks for text and address are added the same way.

Dashboard as an app on your iPhone

Via Share › “Add to Home Screen” the dashboard becomes an app with its own icon and no browser bar – and push notifications now arrive on iPhone and iPad. Channels › Web Push explains how.

n8n

A dedicated trigger starts workflows on incidents, recoveries, changes and expiry warnings and sets up its webhook by itself; the DomainWarn node manages domains and incidents and runs the free checks.

Unused Free accounts are paused

If nobody signs in to a Free account for twelve months, monitoring pauses. We announce this by email 30 and 7 days in advance. The next sign-in resumes everything immediately; domains and history are kept. Paid plans are never paused.

Free plan: three domains for good for everyone who signs up in 2026

If you sign up by 31 December 2026, you keep three domains on Free for good – also after your trial or a subscription, nothing changes for you. Accounts created from 1 January 2027 monitor one domain on Free, otherwise with the same scope; further domains are paused, nothing is deleted.

Compliance report with Microsoft 365

If your mailboxes are on Microsoft 365, the compliance report now shows implicit TLS for mail clients only as a note: Microsoft 365 does not offer port 465, and this cannot be changed. For DNSSEC of the mail server zone, it lists the steps to switch it on in Microsoft 365.

Autoconfiguration with PACC

The mail autoconfiguration check now also knows PACC, the new way mail apps fetch their settings from ua-auto-config.<domain> (Stalwart suggests the record). If the name is set up, DomainWarn checks the certificate, TLS 1.3, the JSON file and its digest in DNS and warns when mail apps would discard the configuration – for example because the server only shows a default certificate. Without the record there is no alert.

Monthly report with a new design

The report for your clients now shows the key figures as tiles – availability against the SLA at a glance –, states and deadlines as coloured labels, readable dates and durations, incidents as cards and page numbers in the footer. The email that comes with it is redesigned too; your white-label applies as before.

Settings at full width

Settings and client pages now use the full width: fields sit side by side, and where there are several areas they appear in two columns – on a client’s status page, for example, the custom address sits to the right of the link and badge.

“Website” tab at a glance

Availability, protocol with compression, certificate, PageSpeed with the Core Web Vitals and the website check now sit right in the tab instead of behind further pages. Every tile of the website check leads to the affected pages.

Heartbeats with reliability and tolerance

Every heartbeat now shows the last 30 days with on-time, late and missed runs and the share of on-time runs – for WordPress and Shopware too. If you like, a heartbeat only alerts once several runs in a row have been missed.

Compression and caching of files

The website check now also tests your website’s stylesheets, scripts, fonts and images: whether they are delivered compressed and whether the browser may cache them. “What to do?” explains how to set this up at your host, in your web server, in your CDN or with a caching plugin.

Auto-renewal via IONOS too

For domains at IONOS, auto-renewal, transfer lock and expiry date now also come straight from the registrar – with the API key you have already added.

If MTA-STS runs on your own mail server, your BIMI record names your own logo or you maintain the security.txt yourself, Email and Website now show “Set up elsewhere” with what the check found – mode, mail servers, max age and ID, logo or contacts. Until now they said “Not set up” whenever DomainWarn itself served nothing. Switching to hosting by DomainWarn anyway asks you first.

Times in messages now appear as date and time in your organization’s time zone instead of a raw timestamp, and durations as “1 day and 10 hours” instead of “1.4 d” – in the dashboard, in notifications and in the tools.

When the HTTP/3 monitor confirms that your website speaks QUIC, the “Website” row now shows HTTP/3 instead of HTTP/2.

In the dark theme, coloured areas are readable again, such as the changes between two zone backups, the channel test result and hints in the DMARC assistant.

Buttons in our emails, such as “Open dashboard”, no longer show up as a light box with a dark bar in mail apps with a dark theme, but as one solid area in DomainWarn blue.

When a certificate authority renews a certificate that is still valid, “Certificate issuance” no longer reports it as unknown – for example Cloudflare, which renews its certificate at Google Trust Services every 60 days.

The subheadings under “More checks” on the “Website” tab have proper spacing above the first check again.

Checks no longer fail now and then: website checks and other requests occasionally came back empty two or three times a day and only ran again at the next interval.

“Certificate issuance” reports new certificates for your domains within minutes again; for very large certificate logs the delay was up to two hours at times.

Via MCP, domains and incidents now return the text of every finding; until now it was empty.

When a client’s status page runs under their own address or you have hidden “with DomainWarn” in your white-label, it no longer mentions DomainWarn – not at the bottom of the page, in the title, in the preview or in the favicon.

With white-label, the status page’s subscription form, confirmation, unsubscribe page and subscription emails also appear without DomainWarn. You set the link to your own privacy policy in white-label.

The DNS history now orders two states from the same second reliably. Until now, the current state, the list and the comparison with the previous state could pick the wrong one.

Compression of your website

The website check now shows whether your pages are delivered compressed – with Brotli, zstd or gzip – and reports it when they are not. “What to do?” explains how to switch compression on at your host, in your web server or in your CDN. The header tool and the domain check test it too.

Incidents in the client report

In the monthly report for your clients you can now choose per client what goes in: which sections and how much about each incident – timeline, who acknowledged it, cause and measures, before and after. You can hide single incidents, and a preview shows exactly the PDF your client receives.

Auto-renewal and transfer lock from the registrar

Through the INWX, OVHcloud and Route 53 integrations, DomainWarn now sees whether a domain renews automatically and whether the transfer lock is set. If a domain renews on its own, DomainWarn only warns when it has not been renewed a week before expiry – instead of a month ahead.

Extensions overview

Under Settings › Extensions you find every installation of the WordPress plugin and the Shopware extension with domain, version, last report and heartbeat state. A badge shows whether an installation reports regularly, is late or has been silent for more than a day; one click takes you to the domain’s inside view.

Status right inside WordPress and Shopware

In the new version of the WordPress plugin and the Shopware extension, the settings page shows whether the connection works, which addresses are monitored, the last report, the last error with its reason, the heartbeat and the next scheduled run. If WP-Cron is stuck, the matching cron job line is shown right there.

DomainWarn in Codex, ChatGPT, Claude and Zed

Under Settings › API there are now ready-made instructions to connect DomainWarn via MCP in Codex, ChatGPT, Claude.ai, Claude Desktop and Zed – in addition to Claude Code, Cursor and VS Code.

API examples to choose from

Under Settings › API you pick a language and a task and get the matching example with your address – for curl, PHP, JavaScript, Python, Go, PowerShell and more. For Prometheus, Grafana, Zabbix, Checkmk, Nagios, Uptime Kuma, PRTG and other monitoring systems there is a ready-made configuration. The same examples are in the docs.

Alerts delivered after an outage

If DomainWarn could not deliver an alert in time because of an outage on our side, it now arrives late with a note about the original time, as long as the incident is still open. Daily digests are sent afterwards.

Faster pages

The website and the dashboard load noticeably faster: pages and scripts are now compressed, the home page to about a seventh of its previous size.

Missed heartbeat with a cause

If the heartbeat of the WordPress plugin or the Shopware extension stops, DomainWarn names the likely cause – such as WP-Cron switched off without a cron job at the host, an unreachable website or a deactivated extension – and under “What to do?” the ready-made cron job line for your domain or the commands for Shopware.

Logos for systems, providers and channels

Wherever WordPress, Shopware, Nuxt, MariaDB, nginx, Cloudflare, Slack and the like appear, you now see their logo: on the CMS badge and in the CMS filter of the domain list, in the inside view, with the DNS integrations, the notification channels and the extensions. That way you find what you are looking for at a glance.

White-label from Agency

Reports in your own design and client emails through your own mail server are now included in the Agency plan, not only in Agency Pro.

Cron job instructions without a request from outside

If WP-Cron stalls, DomainWarn and the WordPress plugin now suggest a cron job that runs wp-cron.php directly with PHP on the server (or via WP-CLI) instead of calling the website over the network. The plugin shows the command with the right path and the matching PHP version, ready to copy.

Pure redirect domains no longer show a CMS. If a domain redirects to another one, it used to show the system of the target site; it now says “Redirects to …”.

The zone backup now reliably detects the latest snapshot even when two snapshots are taken in the same second, for example when restoring and backing up right after. Previously a run could compare against an older snapshot and report a change that was none.

When a website’s PageSpeed result changes, DomainWarn again confirms the change with a second measurement. Until now this confirmation stopped before Google had answered, and the change only showed up with the next regular measurement.

WooCommerce no longer shows up as a CMS of its own but as what it is: WordPress. Websites whose theme sets its own generator meta tag or ships WooCommerce styles (such as Divi) are no longer mistaken for shops. The cart-to-checkout journey template is still suggested when WooCommerce actually runs.

HTTP/3 monitoring

If a website advertises HTTP/3 via Alt-Svc, DomainWarn checks hourly (every 6 hours on Free) whether it also answers over QUIC. If UDP 443 is closed after a server move or firewall change, browsers wait and fall back to HTTP/2; the site feels slow although it is reachable. If HTTP/3 does not answer twice in a row, DomainWarn opens an incident. Switching HTTP/3 on or off shows up in the timeline. The monitor switches itself on as soon as the website offers HTTP/3; with HTTP/2 only it stays off, and you can switch it yourself in the settings at any time.

HTTP/3 check as a tool

The new free tool shows the Alt-Svc header per host and whether the website answers over QUIC. It is also part of the domain check, which now covers twenty checks; missing HTTP/3 costs no points there.

Change your email address

Under Profile › Email address, enter a new address together with your password. The change only takes effect once you click the link sent to the new address; until then your current address stays in use and you can discard the change. Afterwards your old address gets a notice, so a change never goes unnoticed. While the new address is unconfirmed, the dashboard points this out on every page; if you mistyped it, you can correct it right there.

HTTP/2 or HTTP/3 at a glance

A domain's overview now shows next to availability which protocol the website answers with, for example “HTTP/2 · HTTP/3 active”. If it advertises HTTP/3 but does not answer over QUIC, it says “HTTP/3 broken”. On the “Website” page each check shows its part.

Outdated PHP version in the inside view

If a WordPress or Shopware website runs a PHP version for which a newer patch release in the same branch exists, the inside view warns and explains what to do. Patch releases mainly fix security vulnerabilities. Before, DomainWarn only checked whether the PHP branch still receives security updates. No extension update is needed for this.

Account only after confirming the email address

After signing up, you continue once you have clicked the link in the confirmation email; before, DomainWarn could also be used with someone else's address. Until then you can request the email again or correct a mistyped address, and the link goes to the new one. If you come via an invitation, there is nothing to confirm – the invitation went to exactly that address.

Bulk actions in the domain list

Select domains in the list with checkboxes – one by one, a range with Shift, the whole page or all matches of the filter up to 500. The action bar pauses, resumes, assigns a client, switches areas, sets the check interval of one check type, checks right away or deletes – each after a confirmation that names the number. Large selections run in the background with a progress bar, and skipped domains are listed with a reason. On a phone, the bar sits at the bottom.

OVHcloud as a DNS provider

OVHcloud now connects like Cloudflare, Hetzner, IONOS, netcup, INWX, Route 53, deSEC and autoDNS: choose the region, enter application key, application secret and consumer key, import zones and add missing records for DMARC, SPF, TLS-RPT and CAA in one click – as well as the records for MTA-STS, BIMI and security.txt. This works for domains on OVHcloud name servers in Europe, Canada and the USA (OVHcloud US). DomainWarn activates every change right away by refreshing the zone. The required rights are in the guide in the dialog.

SPF flattening

If the SPF record needs more than ten DNS lookups, DomainWarn resolves the included services into networks, publishes them at _spf of the domain and keeps them current daily; the SPF record then only includes this one record. With a connected DNS provider in one click and, if you like, with automatic updates, otherwise with a notice as soon as the networks change. In the "Email" tab of every domain, from the Freelancer plan.

Mail autoconfiguration

A new check in the email area shows whether Outlook, Thunderbird and phones find servers and ports on their own: Outlook Autodiscover, Thunderbird Autoconfig and SRV records. A certificate that is not issued for autodiscover.<domain> – usually through a wildcard record pointing to the web server –, an SRV record pointing nowhere or a broken Autoconfig file is a warning, because Outlook then shows a certificate prompt again and again. Microsoft 365 is detected, and if nothing is set up at all, you only get a hint. The check runs daily in all plans and only for domains that receive mail.

Subdomain takeover detection

A new daily check in the security area looks for orphaned DNS records: CNAMEs to deleted Azure apps, unclaimed names at Heroku, Amazon S3, Shopify, Netlify and other services and subdomains delegated to name servers that no longer hold the zone. Someone else could take over a subdomain through such records; DomainWarn reports it as a critical incident with the way to fix it. Checked are the domain, all website hosts, the host names from the CT logs and common prefixes for test and campaign sites – from the Freelancer plan.

deSEC DNS provider

Alongside Cloudflare, Hetzner and the other providers, deSEC now connects too: import zones and add missing records for DMARC, SPF, TLS-RPT and CAA as well as the records for MTA-STS and BIMI with one click. The token can be restricted to single domains by a policy at deSEC, other values under the same name are kept.

Platform health in the inside view

The new versions of the WordPress plugin and the Shopware extension also report PHP settings, database and web server version and the key switches of the platform – for WordPress for example public error display, disabled automatic updates, a stuck WP-Cron or missing HTTPS, for Shopware debug mode, background worker, HTTP cache and stuck scheduled tasks. DomainWarn rates this against the support periods of PHP, MySQL and MariaDB, the PHP versions your CMS version supports and the platform recommendations, and shows the recommendations with “What to do?” in the inside view.

Critical platform findings as an incident

If the website runs on a PHP or database version without security updates, WordPress displays errors publicly or a live shop runs in debug mode, DomainWarn opens a “Website platform critical” incident right away – with notifications like any other incident. It closes as soon as the plugin no longer reports a critical finding; warnings and hints stay in the inside view. In the plugin, the switch “Report platform health” (on by default) controls whether the platform data is sent – switched off, DomainWarn opens no such incident and closes an open one. If the plugin stops reporting for 24 hours while the website is reachable – for example because it was uninstalled –, the incident closes on its own.

Email delivery log

Under Notifications you see every email per recipient with its status: sent, rejected, undeliverable or reported as spam. Addresses that repeatedly fail to receive mail are marked unreachable – on the channel and in the member list – and get nothing more until you reactivate them with one click.

Zone backup

If a domain's zone is hosted at Cloudflare, Hetzner, IONOS, netcup, INWX or Amazon Route 53 and the provider is connected, DomainWarn records the complete state every night – with TTLs and including the records nobody sees from outside, such as internal names or service records. A new state is only stored when something changed; the changes appear colour-coded under DNS → Zone backup and in the timeline. Every state can be downloaded as a BIND zone file or JSON, and single records, a single change or the whole zone can be restored at the provider with one click – with confirmation and an audit log entry. Only what the outside monitoring does not report anyway triggers a notification.

Test delivery with result and confirmation of outside recipients

Test delivery sends a clearly marked test message with an example incident on a made-up domain and shows below the channel whether it arrived – for webhooks and chat services with the HTTP status of the endpoint and the error text. If you add an address to an email or own-SMTP channel that does not belong to a member, that person first confirms receipt via a link; until then they receive nothing, and the channel shows “Confirmation pending” with “Send again”.

autoDNS by InterNetX as a DNS provider

Alongside Cloudflare, Hetzner, IONOS, netcup, INWX, Route 53 and deSEC, autoDNS now connects: user, password and context of a dedicated autoDNS user are all it takes. Import zones into the portfolio, and add missing records for DMARC, SPF, TLS-RPT and CAA as well as the records for MTA-STS, BIMI and security.txt with one click – for domains on the autoDNS name servers (ns14.net, domain-robot.org).

Website check finds mixed content and missing SRI

The website check now also examines every checked page for resources loaded over http://: browsers block scripts, stylesheets, frames and form targets on an https page – this is now a critical incident –, images and media over http:// are a warning. External scripts and stylesheets without an integrity hash or without crossorigin appear as a hint. Each finding shows the count and examples with their page on the “Website check” subpage and in the free tool.

More precise CMS version

With the DomainWarn plugin for WordPress or Shopware installed, the version it reports is authoritative – even when the website hides its version. The domain list marks it with a plug icon, and a new version reported by the plugin is checked right away. Without the plugin, DomainWarn also reads the WordPress feed. You get a warning when a security or maintenance update is available for your version line or its security support ends within the next 120 days (support periods from endoflife.date, now also for TYPO3); a newer major version while your line is still maintained is just a hint. If the website shows no version, the domain page points to the plugin.

Journeys set up faster

Journeys have their own row right in the “Website” tab of every domain, with count and status. If DomainWarn detects Shopware or WooCommerce, the row suggests the cart-to-checkout journey and opens the editor with the matching template. Without a journey, the templates are the starting point – one click is enough. The editor is tidier: all fields of a step sit on one line with the label always above, “Create journey” sits top right, and test run, cancel and save sit at the foot of the card.

A consistent way back

Every subpage of a domain has a back button above the title that leads to the tab it belongs to and names it – for example “← Website” from the website checks and “← Email” from the mail server. Next to it, the domain is a link. Until now, some pages led to the domain instead of the tab, and the way back was just a small line of text.

Clearer DMARC and TLS reports

The table of senders shows DKIM, SPF and DMARC consistently as coloured badges, the treatment at the receiver in words (“14 × spam folder”) and the failure types from TLS reports translated; a legend explains the columns. The columns no longer run into each other.

Handbook with one page per integration

WordPress, Shopware, Chrome, the DNS providers, MTA-STS, BIMI and all other integrations now have their own handbook page, as does every check area such as website, email or heartbeats. The overview has a search across all pages, the table of contents at the side shows the subpages of the chapter, and “Learn more” below a finding leads straight to the matching page. Old links keep working.

Web push your way

Every registered device can be muted in the device list without unregistering it and gets its own minimum level – for example the phone for critical only. In your profile, “Receive web push on my devices” mutes all your devices at once. Whatever is filtered out this way does not count as a channel error.

Changelog by calendar week

This page names every week by its calendar week and sorts the items into New, Improved and Fixed.

WooCommerce shops are measured against the WordPress version. Until now, the WooCommerce version number could be taken as the WordPress version.

The plan cards on the pricing page use the full width, and the feature list has two columns on large screens. Until now, the cards looked squeezed.

“What to do?” under every finding

Warnings and outages in the dashboard – on the overview under “Needs attention” as well as on the area and email pages – now have an expander with concrete steps to fix them, a “Fix” button when the record can be created in one click via the DNS integration, “Open” for the page where you set it up, and “Learn more” with the matching explanation.

Look-alike domains as a phishing early warning

DomainWarn checks up to 250 spellings of every customer domain daily – typos, rn instead of m, other TLDs, -shop or -login, accents – and reports as soon as someone registers one of them and puts it into use with a website or mail server. Whatever existed before the first check counts as the baseline and raises no warning. The domain page shows the number of registered variants under “Security”, a dedicated page lists them with date and services; domains owned by the customer are marked as “ours”. From Freelancer.

Website check

DomainWarn now checks every client domain daily beyond the homepage – robots.txt, sitemap (including sitemap indexes), up to 50 sitemap URLs and 100 internal links of the homepage with status, redirect, noindex and canonical. If robots.txt blocks everything or many pages are broken, an incident opens; every newly broken page and dead link appears as a change in the timeline. The row “Website check: 48 pages checked · 2 problems” in the “Website” area leads to the table of all URLs. From the Freelancer plan on.

New free tool “Website Check”

Up to 20 URLs of a website with dead links, broken sitemap entries, accidental noindex and mismatching canonicals – with guidance on fixing robots.txt, sitemap and canonicals in WordPress, Yoast, Shopware and Nuxt.

Reports and customer emails through your own mail server

With white-label, under “Reports in your own design” you pick an existing SMTP channel or enter your own credentials and set the sender name, sender address and reply address. Monthly reports and customer-access invitations then come from your address; emails to your team still come from DomainWarn. You confirm the sender address with a code that DomainWarn sends to exactly that address. If your server fails, the email goes once via DomainWarn, the error is shown next to the setting and your team gets a message after three consecutive failures. Plus “Send test email to me”, a preview with sender and logo as in the real report email, and a hint whether the SPF record of your sender domain includes the mail server.

Page monitors

Watch a domain’s login, checkout, search, contact form, API endpoints or test environments individually – with a name, expected status codes (ranges like 200–299 included), a response-time threshold, GET/HEAD/POST, content rules and an optional bearer token. Each page raises its own incidents under its name, the domain overview shows state, response time and 30-day uptime per page, and the monthly report lists them separately. Depending on the plan, 1 to 50 pages per domain.

Contract and costs per domain

Hosting provider, contract end, notice period, automatic renewal, annual cost, cost centre and who takes care of it – as its own row in the domain settings, with the registrar suggested from the domain check. The new “Expirations” page shows what is due in the next 90 days: domains, certificates, contract ends and last days to cancel by date, filtered per client, with annual totals and as CSV. DomainWarn reminds you 30 and 7 days before the last day to cancel and before a contract end without renewal, both dates are in the calendar subscription too, and the monthly report gets a “Due in the next 90 days” section.

Your clients’ status page now shows the past

Per domain one bar per day for the last 90 days (fine, incident, no data – with date and minutes of downtime on hover) and below it the resolved incidents of the last 90 days by day, in plain words such as “Website unreachable” or “Certificate”, with start and duration. Both can be switched off per client.

Visitors of the status page can sign up for incident notifications

Once they confirm via the link in an email and a button on the page, they receive an email when an incident is detected and when it is resolved – during planned maintenance only after it ends –, in the language of the page, with your white-label name as sender and an unsubscribe link in every email. Under Client › Status page you see the subscribers, can remove them and switch subscriptions off.

Open services in the new “Security” area

DomainWarn checks daily whether well-known database, remote access or plain-text ports on your clients’ website and mail servers accept connections from the internet – by a plain connection attempt against a fixed list, without a port scan and without sending data. An open database or remote access port is a critical incident with a concrete recommendation (firewall, bind to localhost, VPN), FTP and POP3/IMAP without TLS a warning, SSH a notice. Mark expected services as “expected” in the table; newly opened or closed ports appear in the timeline. From the Freelancer plan, once the check is enabled for your location.

Journeys for shops

Every 15 minutes a real browser adds a product to the cart and goes to checkout – or checks that the login page is up. Pick a template (Shopware 6, WooCommerce, login), adjust the steps and watch the outcome per step in a test run. If a step fails twice in a row, you get a critical incident with the step, the error and the page text; form values stay encrypted. From the Agency plan, in the “Website” area of the domain.

security.txt directly under your clients’ domains instead of a redirect to DomainWarn

The security.txt card now offers snippets for common web servers such as Apache and nginx that let the web server fetch the file from DomainWarn and serve it itself; the redirect remains an option. On Cloudflare, DomainWarn sets up a Worker for this in one click, and the WordPress and Shopware extensions serve the file themselves – cached, so it stays available even if DomainWarn is unreachable. DomainWarn recognises the directly served file as active and flags an outdated copy.

BIMI logo under your clients’ domains

Once bimi.client.com points to DomainWarn via CNAME, the logo is served there with its own certificate. The recommended BIMI record only names the new address once the logo actually arrives there, and the previous one again after a longer outage; with automatic updates on, DomainWarn switches the record itself in both directions.

Connect reports with the DNS provider

With the “Reports to DomainWarn” switch on the DMARC, TLS-RPT and Reports pages, DomainWarn adds the domain’s report address to the DMARC record and the TLS-RPT record in one click – in addition to existing targets or as the only target (“DomainWarn only”), after a preview of both records and your confirmation. If there is no TLS-RPT record, DomainWarn creates it. The page also shows the domain’s actual DMARC record with the address instead of a sample.

Maintenance windows apply to all domains, one client or a selection of several domains, with a note and the creator. During a window checks keep running, but outages and slow responses of website, mail server and DNS do not open an incident, open incidents get no reminder, and the time counts neither in the 30-day uptime nor in the monthly report as downtime – the report lists maintenance minutes as a separate figure. Deadlines and configuration findings such as an expiring certificate are still reported.

The status page announces maintenance windows that are running or start within the next seven days as “Planned maintenance”; in the dashboard affected domains carry a “Maintenance” badge, and the settings show at a glance how many windows are active or planned.

Clearer domain pages

Every detail page under “E-Mail” and “Website” shows on the right, always in the same order, the status with “Check now”, the management – a “Managed by DomainWarn” or “Reports to DomainWarn” switch or the note “Maintained by you”, below it the one-click way to the DNS provider with preview and confirmation – and the findings with suggestions to fix them. MTA-STS and the BIMI logo now live in the “E-Mail” tab, the security.txt in the new “Website” tab; the “Hosting” tab is gone, old links lead to the new place.

Clearer expirations

Every domain shows its favicon, every client its logo, and the provider column the logo of well-known registrars, hosts and certificate authorities such as IONOS, Hetzner, Cloudflare or Let’s Encrypt. For certificates the provider is the issuing authority – “Let’s Encrypt” instead of the issuer’s full technical name.

One-click setup cleans up

If the zone holds several DomainWarn records for MTA-STS or BIMI – after a new policy, for example – DomainWarn merges them into one without asking. Foreign values, A or AAAA records next to the CNAME and a foreign Cloudflare route are replaced or removed after your confirmation instead of “Cannot be fixed in one click”. Only records that still look exactly as in the preview are deleted.

Signing up from an invitation puts you straight into the inviting organisation instead of making you create one of your own first. Invitations, password resets and confirmation emails arrive in the recipient’s language, invitations for client access with your white-label name.

A status page under its own address such as status.client.com only goes live after a TXT record proof shown in the client dialog. Nobody can take over an address that still points to DomainWarn or claim it in advance. Addresses already set up keep working without any action.

Passkeys now require verification by PIN, fingerprint or face

A security key without a PIN no longer replaces password and second factor.

The hosted MTA-STS address (mta-sts.your-domain.com) now serves only the policy file: every other address answers with a plain “Not found” instead of DomainWarn’s error page, and search engines are kept out via robots.txt. Until now, Search Console could find a foreign page there.

Two systems under one domain – say WordPress on client.com and Shopware on shop.client.com – now report their inside view and heartbeat separately instead of overwriting each other; the domain page shows one block per installation.

Brief DNS hiccups (SERVFAIL, timeouts) no longer report a removed or invalid record for SPF, DMARC, DKIM, MX, MTA-STS and the other DNS checks. SPF evaluates nested includes, redirect and terms after all correctly, DMARC and BIMI read pct and size limits properly.

Website, blacklist, CMS, privacy and mail server checks report fewer false findings – such as blocked-query answers of blacklists as a listing, jQuery versions as the WordPress version, links with a foreign scheme as dead, or a disconnect after the SMTP greeting as missing STARTTLS.

All-clear messages arrive during quiet hours too and only on channels with a matching minimum severity, Telegram channels can be edited without a new bot token, PagerDuty and Opsgenie trigger per incident, and brief network or DNS hiccups at the provider no longer mark webhook, SMTP and push channels as broken. Durations and severities appear in the organisation’s language.

The status page under its own address shows texts instead of placeholders, groups the history by local day and formats numbers in the page language; the resolution reaches all subscribers even if one address is undeliverable.

A plan change only takes effect once the payment succeeds; with an open payment the dashboard leads to the customer portal. Deleting an organisation cancels every open subscription.

“Assign to client” in the WordPress and Shopware extensions now really assigns new domains to the client. WordPress keeps a freshly typed token on “Test connection” and covers all sites of a network; the ineffective switch for adding the addresses is gone. The Chrome extension recognises Austrian endings such as co.at and rejects an unencrypted API address with a message.

Failed actions in the dashboard report the reason instead of failing silently; the security log and the incident list load older entries, calendar days and month selection follow your time zone, and the organisation can be switched on a smartphone too.

DANE no longer reports a “broken signature” warning for mail servers in zones without DNSSEC whose name servers answer the TLSA lookup with an error – for example Microsoft 365 (*.mail.protection.outlook.com). DANE does not apply there anyway and delivery was never affected; instead a notice appears, for Microsoft 365 with the way to a DANE-capable MX.

A domain’s state (list, overview, domain header, digest) now matches “Needs attention”: a check with a warning that is still below the incident threshold – such as the first of two required runs of a daily check – also puts the domain on warning. Until now it stayed “healthy”. Notifications are still sent for incidents only, and your clients’ status page still shows incidents only.

Availability in the WordPress and Shopware back office

A widget on the WordPress dashboard and a card in the Shopware shop admin show, per domain, the availability over the last 30 days, the response time of the last 7 days as a small chart, when certificate and domain expire and the open incidents – with a link to the domain in DomainWarn. Opening the back office sends no request anywhere; the figures arrive with the scheduled run.

Signed in, the Chrome extension shows the same figures under a monitored domain

Availability, response time and expiry dates. It is now in the Chrome Web Store; the links to the Web Store and the WordPress directory are on the home page and at the bottom of every page.

One-click setup

If the zone is at a connected DNS provider (Cloudflare, Hetzner DNS, IONOS, netcup, INWX, Route 53), DomainWarn creates the records for MTA-STS, BIMI and security.txt itself. A preview first shows what will be created or changed; DomainWarn only replaces existing entries after you confirm and never deletes anything. On Cloudflare, the matching redirect for security.txt is created as well.

Keep the TXT record up to date automatically

If you like, DomainWarn updates the MTA-STS or BIMI record itself after every policy change or new logo. If that fails, the card shows the reason and you get a notification.

New “Hosting” tab on the domain page

MTA-STS, BIMI logo and security.txt as an overview with the state of each feature; one click opens the setup.

DMARC assistant

DomainWarn evaluates a domain’s DMARC reports, shows which senders still fail and tells you when the next step from p=none via quarantine to reject is safe. With a DNS integration you set the new record in one click, after a preview and confirmation.

PageSpeed history

Every week measures mobile and desktop. A dedicated page shows the score over time, the Core Web Vitals rated against Google’s thresholds and the change since the last measurement; the monthly report has a PageSpeed section.

Monthly report with “Hosted by us”

MTA-STS, BIMI logo and security.txt per domain with their state and one sentence on the benefit for your client – in white-label reports too.

Three new free tools

CAA (does the record match the certificate authority that issues your certificate?), name servers (reachable, authoritative and in sync) and IPv6.

BIMI logos are converted to the required SVG format on upload instead of being rejected over formalities. Before saving you see every change with before and after; a logo that already fits stays untouched.

Overview instead of many forms

Settings, notifications, profile, security and a domain’s settings show one row per section with its current state, and one click opens a page with exactly one form. Clients have their own page instead of a large dialog, and content sits in a centered column.

The domain page at a glance

Only what needs attention is at the top, followed by one row per area such as “9 checks · all fine”. DNS shows one row per record type instead of a long list, and the “E-Mail” tab one row each for mail servers, SPF, DKIM, DMARC, TLS-RPT and reports with the key facts; details open with a click.

Uploading files is easier to spot

A clearly visible area with “Choose file”, the allowed formats and the name of the chosen file, and drag and drop works too.

Fix more findings in one click

An overly open SPF (+all or ?all becomes ~all), a CAA entry for the certificate authority that actually issues the certificate, and TLS-RPT with the domain’s report address. DomainWarn only changes existing records after you confirm and never deletes anything.

The domain check now covers nineteen points

IPv6, security.txt, third parties before consent, BIMI, name servers and CAA are new. Optional features that are missing cost no points – only real problems count.

Certificate issuers are readable

Instead of a technical line like “CN=YR2, O=Let’s Encrypt, C=US” you see the certificate authority, the intermediate certificate and the country – on the domain page and in the SSL tool.

Subdomains are checked correctly

DMARC and BIMI apply via the main domain, missing MX or SPF records are just a hint for a subdomain, and redirects are tested for exactly that address.

The hosted MTA-STS policy was unreachable in some browsers and briefly dropped out during short DNS hiccups.

A failed SSL or SMTP check now only states the connection problem instead of internal error messages.

The PageSpeed check delivers measurements again; if none arrives, the reason is shown.

The blacklist check in the domain check runs completely again, and providers like Google with different serial numbers per name server are no longer flagged by mistake.

An area in the domain page header no longer turns grey just because one check hasn’t run yet.

The DKIM selector field is no longer overwritten while you type.

Brief outages of a domain’s name servers no longer cause false alerts about missing MX, SPF or DMARC records. SPF records with exp= or macros are read correctly, and a wrong host name in a certificate no longer also reports an invalid certificate chain.

When an incident escalates from warning to critical, the domain shows the new state right away, and a change is no longer reported twice.

Notifications are no longer lost when many changes happen at once, the daily summary no longer fails on the day the clocks change, and one rejected email recipient no longer holds up the others.

For organizations in time zones west of UTC, the monthly report covered the previous month.

A domain moved to another organization takes its inside view, email reports and PageSpeed history along.

Saving settings, profile, notifications and a domain’s settings now tells you when something was rejected instead of silently doing nothing.

The status page under a client’s own address showed the DomainWarn home page instead of the status page.

Extension for Shopware 6 (tested with 6.6 and 6.7)

It takes the domains of all sales channels into monitoring and reports Shopware and PHP version, extensions with a pending update, sender address and mail server, and maintenance mode. In the shop admin under Settings → DomainWarn you see domains with their state, add missing ones with a button and find open incidents.

Extension for WordPress, installable from the official plugin directory

It reports WordPress and PHP version, plugins and themes with a pending update, mail setup and maintenance mode. If a domain detected as WordPress reports no inside view yet, a button in the dashboard takes you there.

Both extensions send a heartbeat every 15 minutes. If it stops, scheduled tasks no longer run – the site still answers perfectly but sends no order mails and processes nothing. That is exactly what DomainWarn reports.

DomainWarn rates the inside view

Outdated or unsupported version, PHP without security updates, extensions with a pending update, a sender address that doesn’t match the domain, and active maintenance mode.

“Connect with DomainWarn”

You pick the organization in DomainWarn and confirm, and the token reaches the site server to server, never through the browser. “Assign to client” is a list, so a typo can’t create a second client.

Chrome extension

One click on the icon checks the domain of the page you are on with the same checks as the domain check, including the score and what each fix earns. Works without an account; with a token you see whether the domain is monitored and can add it.

DomainWarn in your editor

Via the Model Context Protocol (MCP), Claude Code, Claude Desktop, Cursor, Zed and VS Code connect to DomainWarn with the address https://api.domainwarn.com/api/v1/mcp and your API token. Without a token the free checks run, with a token the portfolio, incidents and DNS history come along, and only a token with write scope may add domains and acknowledge incidents.

Status pages with notices

Outages, maintenance (up to 14 days ahead) and announcements in your own words. If you like, the page runs at the client’s address, such as status.client.com, and in their language; a status badge with ready-made code shows the overall state in the footer of the client’s website.

SLA target per client

Set the promised availability and see the month to date and the buffer left. If it drops below the target, DomainWarn tells you; the monthly report and status page show the target.

New checks

CMS version (WordPress, TYPO3, Drupal, Joomla, Shopware and more; an outdated version opens an incident, and the domain list can be filtered by system), privacy (which third parties the homepage loads before any consent), PageSpeed (weekly with Core Web Vitals, an incident below 50 points) and security.txt (present, valid and not expired).

Heartbeats for cron jobs and backups

Each heartbeat has its own ping address, schedule and grace period. If the ping doesn’t come or a run reports a failure, there is an incident.

DMARC and TLS-RPT reports

Each domain gets a report address. Incoming reports are evaluated and shown in the “E-Mail” tab with key figures, senders per IP and TLS failures; reports can also be uploaded.

Host MTA-STS with DomainWarn

DomainWarn serves the policy and obtains a dedicated certificate for mta-sts.client.example, renewed automatically – the client only sets one CNAME and one TXT record. An MX entry may start with a wildcard, such as *.mail.protection.outlook.com for Microsoft 365.

Host security.txt and the BIMI logo with DomainWarn

Enter the contacts in the dashboard and set a redirect at the client – DomainWarn serves the file and keeps its expiry date current. An uploaded BIMI logo is checked for the required SVG format, and the client only sets the BIMI record.

Five new free tools

“Is the website down?”, DNS propagation against twelve public resolvers, an email header analyzer (headers are not stored), the homepage privacy check and security.txt. When an optional record such as BIMI or MTA-STS is missing, the tools say “Not set up” instead of “All good”.

Everyday things

Confirmations before deleting, revoking or changing plans appear as a dialog instead of a browser window, the security log shows changes readably in your language, the “Live” dot explains on click what arrives live, and the last owner of an organization can no longer be removed by accident.

Handbook and settings

Code examples, addresses and settings values have a copy button, the command line examples use curl directly, and the integrations page has a group “Website and shop”.

The timeline once again shows line by line what changed for settings such as the MTA-STS policy or a new certificate, instead of an unreadable placeholder – in notifications too.

For domains with and without www, the monthly report sometimes used one monitor, sometimes the other; it now always uses the domain itself. The highlighted arc in the health ring is no longer cut off at the edge of the card.

Domain check on the homepage

An overall score from 0 to 100 in the style of PageSpeed, split into website, email, DNS and domain, with concrete recommendations and the points each fix earns. Below it quick facts such as certificate valid until, HTTP version, mail and DNS provider; the result arrives in about 12 seconds and can be shared by link.

Client access

Clients see – read-only – nothing but their own domains. Client accounts don’t count toward the member limit.

Public status page per client with overall state, 30-day availability and open incidents, by link without a login.

Monthly reports in your own design with your agency’s logo, color and name instead of DomainWarn. A client logo shows in the client list, on the status page and in the monthly report.

DNS providers

Alongside Cloudflare, Hetzner, IONOS, netcup, INWX and Amazon Route 53 now connect. Import zones and add missing records for DMARC, SPF, TLS-RPT and CAA with one click – with conservative values, existing records stay untouched. The instructions are right in the dialog.

Import from a zone file or straight from your DNS provider, with a preview, a note on domains already monitored and a progress bar.

New checks

CAA records match the certificate authority actually issuing, DANE for mail servers, all name servers reachable and in agreement, the website answers over IPv6 when it announces it, and all four spellings (with and without www, http and https) lead to the same address.

Subdomains from public certificate logs appear as suggestions on the domain and are monitored with one click.

Domains can be moved to another organization with monitors, history, incidents and certificates. You create a new organization in a dialog without leaving the dashboard, and passkeys can be renamed.

Commands in Slack and Teams

/domainwarn client.com shows the state, check checks now, list shows where action is needed.

Maintenance windows per organization, client or domain, notes per domain, a calendar feed with domain and certificate expiry, and the domain list as CSV.

Public API with tokens per organization, plus metrics in Prometheus format for Grafana, Zabbix, Checkmk, PRTG or Uptime Kuma. Under Settings → API, a read token and the ready-made configuration are one click away.

A weekly digest as an alternative to the daily one; both can be switched off. Notifications that fall into quiet hours arrive afterwards, as long as the incident is still open.

On the website

A handbook under /docs, API documentation under /docs/api, a page covering all integrations and a detailed plan comparison. app.domainwarn.de redirects to app.domainwarn.com – one login, one passkey.

Website monitors can check content (“page must contain” / “must not contain”), rate security headers as hints and show whether the site speaks HTTP/1.1, HTTP/2 or HTTP/3. Interval, expected status codes and the “slow” threshold are set per monitor.

New dashboard

A top bar with search and live state, navigation on the left, the overview as report cards with a new logo. The search suggests matching domains after two characters, “Check now” shows progress and the result, and relative times like “2 minutes ago” keep ticking on their own.

Domain list

Filters live in the address and can be shared, a client filter shows as a chip, the counters reflect the filtered list, and the list loads faster.

Tool results are readable

The answer in plain language on top (“Certificate valid, expires in 66 days”), the key facts below, raw data folded away under “Technical details”.

Plans

The features of each plan apply, the dashboard points out features outside your plan, and after moving to a smaller plan, what you already have stays.

Availability over 7, 30 and 90 days shows values for newly added domains too, including the current hour.

Sixteen checks per domain

Website availability, SSL certificate, domain expiry, DNS, MX, SPF, DKIM, DMARC, DNSSEC, MTA-STS, TLS-RPT, BIMI, reverse DNS, blacklists, certificate logs and the mail server itself.

Changes to DNS and certificates are detected, confirmed via a second name server and shown as before and after.

Twenty notification channels, among them email, Slack, Microsoft Teams, Discord, Telegram, webhooks, PagerDuty, Opsgenie, SMS and push – with quiet hours, reminders and a daily digest.

Create clients and assign domains; a monthly PDF report per client, sent automatically by mail if you like.

DomainWarn detects a domain’s CMS or shop system and switches off the mail checks where no mail is sent.

Free plan with three domains, free for good. After the 14-day trial, an account without a subscription falls back to Free instead of being locked; the pricing page shows monthly and yearly prices and a comparison table.

Free tools without an account, from SPF to BIMI, plus an email check covering everything that matters for delivery and generators for SPF, DMARC, MTA-STS and TLS-RPT. Guides per hosting provider show what to enter; the tools work without JavaScript too.

Sign in with a two-factor code or a passkey, and export your data at any time.

English at domainwarn.com, German at domainwarn.de, run on servers in Germany.