•100% FREE FOREVER TIER•
Predictable Surveillance Tiers
Start free with 1 root domain — zero credit card required. No per-scan overages. Fixed monthly pricing for automated attack surface reconnaissance, dangling DNS takeovers, and email hygiene.
TIER 00Free Forever
Free Plan
£0/ forever
Permanent zero-cost perimeter watch for a single root domain.
1 Monitored Root Domain
1 Scan Per Week (7-Day Cadence)
20-Provider takeover radar & hygiene
HUD + email incident alerts
1 Solo Operator seat
1 On-Demand Re-Scan / 7 Days
No credit card required
TIER 01Monthly Billing
Starter Plan
£49/ month
Essential automated perimeter defense for fast-moving engineering teams.
3 Monitored Root Domains
Daily automated reconnaissance
Slack incident channels + email alerts
Unlimited on-demand re-scans
3 Engineering Seats (RBAC)
Monthly executive PDF briefings
TIER 02Priority Queue
Pro Plan
£129/ month
High-frequency surveillance and team collaboration for multi-cloud estates.
15 Monitored Root Domains
Hourly continuous scan cadence
Priority reconnaissance queue
Slack + Resend + Webhook delivery
Unlimited engineering team seats
Weekly & monthly executive PDF briefings
// PERIMETER EXPANSION
Why Security Teams Upgrade to Starter
The free tier defends 1 root domain forever. When you run multiple environments, deploy with a team, or need daily automated triage, Starter lifts every limit:
3× Monitored Root Domains
Protect 3 apex estates instead of 1 — cover staging, production, and acquisitions.
Daily 24h Scan Cadence
Dangling CNAMEs and SPF regressions caught within 24 hours instead of waiting 7 days.
Unlimited On-Demand Re-Scans
Zero cooldown. Trigger instant verification whenever engineering pushes DNS updates.
Slack Incident Webhooks
Dispatch critical takeover and TLS alerts straight to #security and #devops in real time.
3 Engineering Seats (RBAC)
Collaborate across teams with granular owner, admin, member, and viewer roles.
Monthly Executive Briefings
Automated PDF security briefings delivered directly to leadership stakeholders on schedule.
Need only 1 domain? Start free forever →
// SPECIFICATION BREAKDOWN
Detailed Feature Matrix
| Feature / Capability | Free (£0) | Starter (£49/mo) | Pro (£129/mo) |
|---|---|---|---|
| Monitored Apex Domains | 1 Monitored Root Domain | 3 Domains | 15 Domains |
| Automated Scan Cadence | 1 Scan Per Week (7-Day Cadence) | Daily (24 Hours) | Hourly (24x / day) |
| On-Demand Re-scans | 1 On-Demand Re-Scan / 7 Days (Starter unlocks unlimited instant re-scans) | Unlimited | Unlimited (Priority) |
| Detection Radars | 20-Provider Takeover, SPF, DMARC, TLS | All Radars Included | All Radars + Priority Engine |
| Incident Notifications | In-Console HUD + Email | Slack Webhooks + Resend | Slack + Resend + Webhook APIs |
| Executive Reports | In-App Dashboard View | Monthly PDF Briefings | Weekly / Monthly Executive PDFs |
| Engineering Seats (RBAC) | 1 Solo Operator | 3 Seats | Unlimited |
| CI/CD Guard API | View Only / Community | Full IaC Guard Telemetry | Full IaC Guard + Policy Hub |
| Credit Card Required | ZERO (Free Forever) | Yes via Stripe | Yes via Stripe |
Free tier is free forever — no trial clock, no credit card, no surprise overage invoices.
// ARCHITECTURAL FAQ
Frequently Answered Questions
Click any question to inspect technical specifications, threat response cadences, and operational guarantees.
Our engine executes active recursive resolution against 20 documented cloud provider signatures (AWS S3, GitHub Pages, Heroku, Azure, CloudFront, etc.). When a CNAME returns a canonical target that responds with an orphan token (such as NoSuchBucket or 404 Web Site not found), SubdomainWatch flags the finding and dispatches an instant transactional alert before an external actor can claim the resource.
RFC 7208 Section 4.6.4 dictates that evaluating an SPF record must not perform more than 10 DNS queries across all mechanisms (include, a, mx, ptr, exists, redirect). If third-party SaaS services (SendGrid, Zendesk, Google Workspace) push your includes beyond 10 lookups, major mail transfer agents return a PermError, silently routing legitimate corporate email to spam or dropping it entirely.
No. SubdomainWatch is 100% external, non-invasive attack surface surveillance. We discover and audit your attack surface from the vantage point of an adversary on the public internet using authoritative DNS resolution, Certificate Transparency (CT) logs, and passive OSINT. All audits adhere to our strict Zero-Retention DNS Guarantee & Vulnerability Disclosure policy.
The Free tier permanently monitors 1 root domain with weekly reconnaissance, the full 20-provider takeover radar, SPF/DNSSEC/TLS radars, in-console HUD and email alerts — with zero credit card required. When your perimeter grows beyond one domain, or you need daily reconnaissance and Slack incident channels, Starter unlocks 3 domains for £49/mo.
Yes. In the Defense Console, you can trigger instant on-demand scans via the 'Re-scan Now' button, or call our API from your CI/CD pipeline (e.g. Terraform or GitHub Actions) to verify DNS propagation immediately. Free workspaces include 1 on-demand re-scan every 7 days (1 scan per week); Starter and Pro include unlimited on-demand re-scans.
Our TLS Expiry Radar categorizes certificates into 30-day, 14-day, and 7-day alert thresholds. Incidents are automatically queued in the Defense Console and transactional alerts are dispatched via Resend email and Slack so your team can intervene before expiration blackouts affect users.
Yes. All paid plans are billed on a flexible month-to-month basis with zero lock-in contracts. You can upgrade from Starter to Pro, or downgrade back to the free tier, directly from your console at any time with one click.
Evaluating alternatives to legacy EASM or passive DNS databases?Read Competitor Comparisons→