Alerts & Notifications
Configure alerts to stay informed about authentication failures, new sending sources, and important changes to your email security.
Alert Types
Authentication Failures
Triggered when emails fail DMARC authentication
New Sending Source
Triggered when an unknown IP starts sending as your domain
DNS Record Changes
Triggered when your DMARC, SPF, or DKIM records change
Policy Recommendation
Suggestions to strengthen your DMARC policy
Report Processing
Notifications about incoming report status
Certificate Expiry
Warning when MTA-STS certificates are expiring
Notification Channels
Choose where you want to receive alerts:
Receive alerts via email to your registered address
Enabled by default for all users
Slack
Get alerts in your Slack channels
Requires Slack integration
Webhook
Send alerts to your own endpoints
Configure in API settings
Configuring Alerts
Access Alert Settings
Navigate to Settings → Alerts in your DDMARC dashboard.
Dashboard → Settings → AlertsEnable/Disable Alert Types
Toggle each alert type on or off based on your preferences. You can also configure per-domain settings.
Set Thresholds
Configure when alerts should trigger to avoid notification fatigue:
| Alert Type | Threshold Options |
|---|---|
| Authentication Failures | > 10, 50, 100, or 500 per hour |
| New Sending Source | Any new IP, or > 10 emails from new IP |
| Failure Rate Spike | > 5%, 10%, or 25% increase |
Configure Delivery
Choose how you want to receive each alert type:
Instant
Receive immediately when triggered
Digest
Batched into hourly or daily summary
Quiet Hours
Suppress during specified times
Creating Custom Alert Rules
For advanced users, create custom rules with specific conditions:
// Alert when failures from unknown IPs exceed threshold
IF source.authorized = false
AND result.dmarc = "fail"
AND count > 50 per 1 hour
THEN alert("critical")Best Practices
- Start with higher thresholds and lower as you understand your baseline
- Use digest mode for informational alerts, instant for critical ones
- Set up Slack for team visibility, email for individual accountability
- Review and tune alert rules monthly based on actual incidents
Avoiding Alert Fatigue
Too many alerts can lead to important ones being ignored. Use these strategies:
- • Mark known sending sources as authorized to reduce false positives
- • Use digest mode for high-volume, low-priority alerts
- • Set quiet hours for non-critical alerts outside business hours
- • Regularly review and disable alerts you never act on