Documentation

Learn how to integrate and use DDMARC.

Docs/Alerts/Custom Rules
8 minutesProtect and above

Custom Alert Rules

A rule watches one metric on one domain (or all of them), compares it to a threshold you set, and raises an alert on the channels you choose. The evaluation engine runs every five minutes.

Anatomy of a rule

A rule is a structured record, not a query language. These are all the fields:

FieldValue
NameUp to 120 characters. Shown on the alert.
DescriptionOptional, up to 500 characters.
MetricOne of the seven metrics listed below.
Operatorlt, lte, gt, gte or eq.
ThresholdA number. Its meaning depends on the metric.
Severitycritical, warning or info.
DomainA single domain, or leave it empty to apply the rule to every domain in the organization.
Notification channelsAny of email, webhook, teams, telegram.
CooldownMinutes between repeat alerts. Default 60, maximum 10080 (one week).
EnabledDisable a rule to pause it without deleting it.

Example rule

WhenPass rateisless than90forexample.com→ raise acriticalalert onemail + webhook, at most once every120 min

The seven metrics

Rate and count metrics are computed over a rolling 24-hour window. Read the units carefully — the threshold means something different for each metric.

Pass rate

pass_rate

Threshold unit

Percentage (0–100)

Share of mail in the last 24 hours where both DKIM and SPF passed. No data in the window means no alert.

Failure count

fail_count

Threshold unit

Number of messages

Count of failing messages in the last 24 hours.

SPF failure rate

spf_fail_rate

Threshold unit

Percentage (0–100)

Share of mail in the last 24 hours where SPF failed.

DKIM failure rate

dkim_fail_rate

Threshold unit

Percentage (0–100)

Share of mail in the last 24 hours where DKIM failed.

DNS change

dns_change

Threshold unit

Presence test

Fires when a DNS check has flagged a change since the last evaluation. The operator and threshold are ignored for this metric.

Volume change

volume_change

Threshold unit

Signed percentage

Last 24 hours against the average day over the previous 7 days. Positive is a rise, negative a fall — so gt 100 catches a doubling and lt -50 catches a halving. Domains averaging under 50 messages a day are skipped.

New senders

new_sender

Threshold unit

Number of sources

Sending sources first detected since this rule was last evaluated.

Comparison operators

Five operators are accepted. There is no "changes" or "contains" operator — to alert on a DNS record changing, use the dns_change metric.

OperatorAPI valueSymbolExample
Less thanlt<Pass rate lt 90
Less than or equalltePass rate lte 95
Greater thangt>Failure count gt 100
Greater than or equalgteNew senders gte 3
Equalseq=Failure count eq 0

Cooldown and deduplication

A rule is evaluated every five minutes. Without a cooldown, a condition that stays true would alert twelve times an hour. The cooldown is the minimum gap between repeat alerts, and it is the only deduplication mechanism — there is no configurable alert grouping.

  • • Default is 60 minutes; the range is 0 to 10080 (one week).
  • • Cooldown is tracked per (rule, domain) pair. An all-domains rule that has just fired for a.example can still fire immediately for b.example.
  • • Setting it to 0 means every matching evaluation raises an alert. Use that only for metrics that are naturally rare.
  • • Lengthening the cooldown is the first lever to pull when a rule is too noisy — before disabling it.

Notification channels

A rule can target any combination of four channel values. Slack and Discord are delivered through webhook; they are not separate selections. Configure the destination for each channel once in Notifications → Settings.

Email email

Emails the organization's users

All plans

Webhook webhook

Your webhook URL — Slack and Discord URLs are auto-formatted

Protect and above

Microsoft Teams teams

Your Teams incoming webhook

Growth and above

Telegram telegram

Your Telegram bot and chat

Growth and above

Managing rules

Enable / disable

Pause a rule without losing its configuration or its fire history.

Check its history

Each rule reports when it was last evaluated, when it last fired, and how many times it has fired in total.

Delete

Remove a rule for good. Alerts it already raised stay in the Notifications centre.

Snoozing applies to alerts, not rules. If a rule has already fired and you want quiet for the next few hours, snooze the alert in the Notifications centre. To silence the rule itself, disable it or extend its cooldown.

Alert rules API

EndpointPurpose
GET /api/v1/alerts/rulesList your rules with their evaluation history
POST /api/v1/alerts/rulesCreate a rule (rate limited to 30 per minute)
PATCH /api/v1/alerts/rules/{rule_id}Update any field, including enabling or disabling
DELETE /api/v1/alerts/rules/{rule_id}Delete a rule

How many rules you can have

PlanCustom rules
Monitor (free)Not available
Protect3 rules
Growth10 rules
Professional25 rules
EnterpriseUnlimited
Partner Starter / PartnerUnlimited

Channel availability follows your plan too: webhook (including Slack and Discord) from Protect, Teams and Telegram from Growth.

Not available yet — Configurable alert grouping

Alerts cannot be grouped by domain, type or severity. The Notifications centre groups them by day and lets you filter by severity and read state; repeat suppression is handled entirely by the per-domain cooldown described above.

Writing rules that stay useful

  • Watch your real numbers for a week before choosing a threshold. A pass-rate floor set above your normal baseline fires constantly and gets muted.
  • Leave the domain empty for org-wide guardrails, and create domain-specific rules only where a domain genuinely behaves differently — you have a limited number of rules.
  • Match severity to the response you actually want. If nobody is paged, it is not critical.
  • Check the fire count occasionally. A rule that has never fired may have a threshold that is unreachable.

Next Steps