Alerts & Notifications
Configure alerts to stay informed about authentication failures, new sending sources, and important changes to your email security.
Alert Types
Authentication Failures
Triggered when emails fail DMARC authentication
New Sending Source
Triggered when an unknown IP starts sending as your domain
DNS Record Changes
Triggered when your DMARC, SPF, or DKIM records change
Policy Recommendation
Suggestions to strengthen your DMARC policy
Report Processing
Notifications about incoming report status
Certificate Expiry
Warning when MTA-STS certificates are expiring
Notification Channels
Choose where you want to receive alerts:
Receive alerts via email to your registered address
Enabled by default for all users
Slack
Get alerts in your Slack workspace channels
Add Slack webhook URL in Settings → Notifications
Discord
Post alerts to your Discord server channels
Add Discord webhook URL in Settings → Notifications
Telegram
Send alerts to Telegram chats via bot
Configure bot token and chat ID in Settings
Microsoft Teams
Deliver alerts to your Teams channels
Add Teams incoming webhook URL
Custom Webhook
Send alerts to any HTTP endpoint
Configure webhook URL and authentication
Configuring Alerts
Access Alert Settings
Navigate to Settings → Alerts in your DDMARC dashboard.
Dashboard → Settings → AlertsEnable/Disable Alert Types
Toggle each alert type on or off based on your preferences. You can also configure per-domain settings.
Set Thresholds
Configure when alerts should trigger to avoid notification fatigue:
| Alert Type | Threshold Options |
|---|---|
| Authentication Failures | > 10, 50, 100, or 500 per hour |
| New Sending Source | Any new IP, or > 10 emails from new IP |
| Failure Rate Spike | > 5%, 10%, or 25% increase |
Configure Delivery
Choose how you want to receive each alert type:
Instant
Receive immediately when triggered
Digest
Batched into hourly or daily summary
Quiet Hours
Suppress during specified times
Creating Custom Alert Rules
For advanced users, create custom rules with specific conditions:
// Alert when failures from unknown IPs exceed threshold
IF source.authorized = false
AND result.dmarc = "fail"
AND count > 50 per 1 hour
THEN alert("critical")Best Practices
- Start with higher thresholds and lower as you understand your baseline
- Use digest mode for informational alerts, instant for critical ones
- Set up Slack for team visibility, email for individual accountability
- Review and tune alert rules monthly based on actual incidents
Avoiding Alert Fatigue
Too many alerts can lead to important ones being ignored. Use these strategies:
- • Mark known sending sources as authorized to reduce false positives
- • Use digest mode for high-volume, low-priority alerts
- • Set quiet hours for non-critical alerts outside business hours
- • Regularly review and disable alerts you never act on