DomainGuard Monitor · Customer quick start
From claim link to active monitoring in a few minutes.
This guide covers customer onboarding for DomainGuard Monitor. No server access or Zeah infrastructure credentials are required; each workspace is isolated to its account, monitored domains, reporting preferences, and integrations.
Claim your workspace
Open the one-time claim link supplied by Zeah. The link exchanges the invitation for a browser session and signs you into your Monitor workspace.
- Claim links are single-use.
- The browser session is stored in a Secure HttpOnly cookie.
- You do not need to paste a long-lived API key into the browser.
Add your first domain
Enter a bare public domain such as example.com and an optional client label. Monitor immediately performs the first scan and stores it as the baseline.
- The first scan establishes state; it does not generate a drift alert.
- Only public domains are accepted.
- The plan controls domain capacity, scan interval and history retention.
Review the baseline
Use the domain detail view to inspect the current score, grade, failed controls, scan time and next scheduled scan.
- Failed controls include evidence and remediation guidance.
- Score history accumulates as scheduled scans run.
- Stable failures remain visible without generating repetitive change events every cycle.
Configure reporting
Set your MSP/company brand name, report title and footer. The report summarizes the portfolio, common failed controls, domain state and recent change events.
- Use the printable report for browser Print / Save as PDF.
- CSV export is available for spreadsheets or downstream reporting.
- Reports are posture summaries—not penetration tests or compliance attestations.
Connect alerts
Add an HTTPS webhook if you want change events pushed into automation or ticketing. Use the per-account signing secret to validate webhook authenticity.
- Webhook destinations must resolve to public/global addresses over HTTPS.
- Deliveries are signed with HMAC-SHA256.
- Failed deliveries are retried with backoff.
Generate a programmatic API key only if needed
The dashboard can create a separate customer API key for scripts, PSA integrations or custom applications. Browser access does not require keeping that key in local storage.
- Rotating the API key invalidates the previous programmatic key.
- Your current browser session remains active after key rotation.
- Keep programmatic keys in a secret store—not in source code or screenshots.
Work the exceptions
Once monitoring is established, the intended workflow is simple: ignore stable state and act when a meaningful event appears.
- Control failure or recovery.
- SPF, DMARC, MX, DNSSEC or mail-policy configuration change.
- Certificate lifetime threshold.
- Meaningful posture deterioration.
- Repeated scan failure.